Story: Clean ores.workspace to the component clean standard

ores.workspace meets the Component Clean Standard: every item: All, Protocol and Entity pass, each item that does not apply is recorded with its reason, and ores.workspace joins COMPONENTS_UNDER_TEST. Order 21 of 35 in the sprint 26 component clean-up, tier 2 (higher infrastructure).

• Every checklist item that applies to a component of kind Entity passes, with its evidence recorded on the task.
• Every item that does not apply is recorded as not applicable, with the reason.
• Every generator defect found is fixed at its source, with a regression test.
• ores.workspace is listed in COMPONENTS_UNDER_TEST, and check_component_drift.py --all passes.

• Survey on 2026-09-23: 1 entity, junction or operation models; 36 C++ files outside tests, 0 of them generated (0%); 3 messaging headers, 3 of them hand-written.
• Nothing is generated yet.
• 2026-09-28: the survey was right and the consequence was worse than it looked. The model was not merely un-generated: it was in the retired format, so its natural key name was read by no loader path and the generated domain type carried neither name nor party_id. The migration is the task's first item and the rest of the pass follows it.

• Keep the two operations the component serves but nothing calls. The ancestor resolution chain and the trade-scope whitelist have no consumer in the tree. They are modelled as an operation model and served by hand-written handlers rather than deleted under P03, because they are the workspace feature's intended surface and the design doc treats the trade-scope filter as unfinished, not abandoned. Deleting them would be a product decision, not a clean-up one.
• Split the component's SQL in the model, not in the aggregator. The table, its triggers and its hierarchy read generate; the resolution-order function, the workspace FK validation function, the trade-scope table and the row-level security stay hand-written. workspace_create.sql is the aggregator and states which includes the generator owns, so the split is readable in one file.
• The Live workspace's lifecycle guard is recorded, not reimplemented. The canonical protocol makes archiving a put and deleting a window close, and the generated service has no seam for a rule the hand-written one enforced. It belongs to the workspace feature story.
• Rename the schema's ownership in the ignore list rather than in the schema. The validation_ignore.txt comment claimed workspaces are tenant-independent; the schema has always carried tenant_id, a version and RLS. The inert entries are removed and the comment now describes the two tables.
• Build the shell part rather than take an exception for it. The first pass disabled the ores.cpp.shell-command facet and recorded S01 as an accepted exception, on the grounds that the generated units would land in a directory no build reaches. That described the tree and not the item: S01 asks for the units, and the part they need is the work. projects/ores.shell/workspace now carries them, the entity's ten verbs run against the live fleet, and the component joins the registry with no exception.

The component is generated, builds, tests, recreates its schema from scratch, is listed in COMPONENTS_UNDER_TEST, carries the namespace documentation headers G08 asks for, and cannot have its Live workspace archived or deleted.