Task: Bind ores.workspace entities to profiles; verify zero-diff regen

Survey every ores.workspace entity against the profile catalogue, rebind matches, regenerate, and require zero additional diff against the pre-rebind checked-in output.

• Every entity discovered via the workspace-cpp catalogue entry is surveyed against all Variability Profiles.
• Every matching entity is rebound and regenerated with zero additional diff versus its pre-rebind checked-in output.
• The has_party_id template flag gap is resolved.
• workspace_service, workspace_repository, and workspace_protocol are each either brought under codegen or verified as a genuinely correct, documented exclusion.
• No-match entities are recorded with their actual feature values, not silently dropped.
• Full local build and ctest green after regeneration.

(Implementation strategy. Written when work starts; key decisions are distilled into the parent story's * Decisions at close, but the plan itself stays — it is the historical record of what we did.)

Manual QA scenarios (scaffolded via compass add test_scenario, run through the QA Validation Runner panel) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.