eval: guard shared workspace render ownership

[schickling-assistant]

Paired with compoundingtech/st2#95 and merged runtime PR compoundingtech/st2#97.

Discriminator

Adds one model-free cell for two active declarations that share a workspace:

• different effective bytes for .st2/PERSONA.md must fail validation
• full materialization must fail before either owner writes
• targeted materialization must not bypass the unselected sibling's claim
• diagnostics must name the target and both owners
• byte-identical shared claims remain valid and idempotent

The cell starts no PTY, Claude, or Codex session. It also updates the generated catalog, explicit model-free harness exclusion, and eval VRS mapping.

AGENT-SPEC.md remains pinned to its current accepted st2 commit in this PR; the new behavior should become normative there only when the repository-wide pin advances.

Current proof

Exact PR head: 1a73f98816cf2c48610bcef59f9aa0de80b8a35d.

Against current merged st2 c6846f6239329f0803142afc06c15a07b93937c1 (binary SHA256 2bba8d58be24250bc262f75f835ce2d780369add275774f3f2135c623d23d29c):

SCORE: 7 PASS / 0 FAIL / 7 gating judges
VERDICT: PASS

The exact head merges cleanly onto current evals main ffe2b14c785018cf365ea4ad87ef634029732b87. On that temporary merge, the complete repository-pinned model-free preflight passed with exact st2 9887b2842222def0838c2cd82e6c24c218f7efa6 / binary SHA256 d49d44fd4f3f6f655455c212353a469fefa956082bedf22163deb767d8a36a0d:

• 73 KDL files parse
• 46 maintained eval folders load; 9 nested catalogs validate strictly
• model-free exclusion inventory matches exactly
• fixture resets and harness contract pass
• no-PII and generated CATALOG.md checks pass
• git diff --check passes

No model/provider call was made.

Historical proof

Before runtime PR #97 merged, the original branch proof was also 7/7 against its then-exact runtime head d691d71. That result is historical; the current proof above supersedes it.

[myobie]

Owner review GREEN: focused model-free cell 7/7 on current merged st2 c6846f6; clean merge onto evals main ffe2b14; complete repository-pinned 9887b28 model-free preflight, generated catalog, harness exclusions, fixture resets, no-PII, shell syntax, and diff check all pass. No provider call.