Story: Entity classification and drift baseline: ores.workspace

Bring ores.workspace to the same proven state as the ores.refdata pilot: every codegen-eligible entity bound to a profile or recorded as a genuine no-match, zero-diff regeneration verified, and any real gap the check surfaces fixed rather than skipped. Once trusted, workspace-cpp is added to the CI regeneration-drift check.

• Every ores.workspace entity is bound to a matching Variability Profile, or recorded as a genuine no-match with a documented reason.
• Every rebound entity is regenerated and diffed against its pre-rebind checked-in output; zero diff is the pass condition, and any non-zero diff is fixed, not worked around.
• Full local build clean, validate_schemas.sh green, full ctest suite green after regeneration.
• check_component_drift.py –components is extended to include workspace-cpp, and the refdata-codegen-drift CI job is updated so future PRs touching ores.workspace fail on any regeneration drift.
• The superseded ad hoc task 'Apply safe drift to workspace-cpp' is marked ABANDONED, pointing here.
• The known starting-point wrinkles already recorded (has_party_id template flag; workspace_service/workspace_repository/workspace_protocol currently hand-crafted and excluded) are each resolved – either brought under codegen properly, or verified as a genuinely correct, documented exclusion – not carried forward as an unexamined restore-from-HEAD step.