v0.5.0 Add WorkspaceService (workspace.proto): server-streaming ExecCommand RPC plus its request/response messages and buf.validate constraints on the command env map. Additive, backward-compatible with v0.4.x — no existing messages, fields, or services changed.