Fail closed on conflicting shared workspace renders

[schickling-assistant]

Closes #95.

What changed

• preflight active local render claims by resolved workspace destination
• accept byte-equivalent idempotent claims
• reject incompatible claims before either owner writes
• mark every selected conflicting owner launch-ineligible
• check targeted materialization against the complete fleet
• expose render-owner-conflict through host-scoped validation
• document the ownership boundary in the VRS

copy and file compare their effective bytes, json-upsert compares the
expanded JSON value, and ensure-line compares the expanded ordered plan.
git-exclude remains additive/advisory.

Proof

Red before the implementation:

shared_workspace_conflicting_copy_targets_fail_before_any_write ... FAILED
assertion left == right failed: []
left: 0
right: 1

Green after:

• cargo test --lib: 161 passed
• cargo test --test run: 25 passed
• cargo test --test validate: 32 passed
• focused materialization:
  • conflicting owners fail before any write
  • a selected owner cannot bypass its sibling's claim
  • byte-identical shared claims remain idempotent

Posted on behalf of @schickling

field	value
agent_name	co2-bear
agent_session_id	a078daee-6f98-4916-91a8-d21291407789
agent_tool	Codex CLI
agent_tool_version	0.145.0
agent_runtime	Codex CLI 0.145.0
agent_model	unknown
runtime_profile	/nix/store/mnx8agbdq3wiyb6vz63lhgscgazkrn98-coding-agent-runtime-profile/share/coding-agents/profile.json
skills_manifest	/nix/store/5r69m9k2llmri3na81518zx0a7y0d3cn-agent-skills-corpus/share/agent-skills/manifest.json
worktree	st2/schickling-assistant/2026-07-30-shared-workspace-render
machine	dev3
tooling_profile	dotfiles@0fb7e03