Pin work_products identity to (company, workspace, path)

The natural key used to be (companyId, provider, externalId), so two
workspaces with the same workspace-relative path collided onto one
row. Provenance was also frozen at the first write: `created_by_run_id`
never refreshed, so a run that edited a pre-existing file never
qualified as a deliverable and the DocumentCenter "open" link could
still jump into the first workspace after a repo move.

Migration v45 adds `workspace_id` + `last_touched_by_run_id`, backfills
`workspace_id` via the task/run join, seeds `last_touched_by_run_id =
created_by_run_id`, and installs a partial unique index on
`(company_id, workspace_id, provider, external_id)` scoped to rows
that have a workspace. The artifact projector now records
`workspace_id` on insert and refreshes `last_touched_by_run_id` on
every upsert. The deliverable signal query reads either provenance
column so a run that only edited a pre-existing file still counts.
`resolveWorkProductTarget` prefers the stored `workspace_id` and falls
back to the task/run join for legacy NULL rows.

src/main/database/snapshot.ts

@@ -130,14 +130,16 @@ export function buildSnapshotMethods(
         tagsJson: r.tags_json, latestRevisionId: r.latest_revision_id ?? null, createdAt: r.created_at, updatedAt: r.updated_at,
       })),
       workProducts: readAll<SqliteRow>(
-        `select id, company_id, project_id, task_id, type, provider, external_id, title, url, status, review_state, is_primary, summary, metadata_json, created_by_run_id, created_at, updated_at from work_products${companyWhere} order by updated_at desc limit 500`,
+        `select id, company_id, project_id, task_id, workspace_id, type, provider, external_id, title, url, status, review_state, is_primary, summary, metadata_json, created_by_run_id, last_touched_by_run_id, created_at, updated_at from work_products${companyWhere} order by updated_at desc limit 500`,
         ...companyArgs,
       ).map((r) => ({
         id: r.id, companyId: r.company_id, projectId: r.project_id, taskId: r.task_id,
+        workspaceId: r.workspace_id ?? null,
         type: r.type, provider: r.provider, externalId: r.external_id, title: r.title,
         url: r.url, status: r.status, reviewState: r.review_state,
         isPrimary: Boolean(r.is_primary), summary: r.summary,
         metadataJson: r.metadata_json, createdByRunId: r.created_by_run_id,
+        lastTouchedByRunId: r.last_touched_by_run_id ?? null,
         createdAt: r.created_at, updatedAt: r.updated_at,
       })),
       knowledgeBase: readAll<SqliteRow>(