Workspace attach: post a sanitized session attach report to the backend when the outcome settles

[ralphstodomingo]

Problem

When a workspace attach settles, the CLI is the only place that knows what the session actually received: which declared tool keys the engine served, which it could not and why (the engine's unfulfilled-keys report), the engine and CLI versions, whether a VS Code bridge was live — or that the engine was missing, too old, or failed to start. None of that reaches the backend, so the workspace page cannot show "your last session received …" or whether a linked project is ready.

Proposal

After the outcome settles in the attach path (engine-overlay.ts), post one session attach report to POST /datamates/{id}/attach-reports through the existing API client, fire-and-forget with a bounded timeout, once per announcement signature (the same dedupe the toast uses). Failed outcomes post too.

• Report: outcome kind; the binding identity the server row already holds (git remote, else project path); CLI version; engine version (null when missing); bridge state; declared and delivered keys; the engine's report; a timestamp.
• Sanitize before sending. Engine detail strings are raw error text and can contain paths or hosts. Reduce each to {code, command?} — code from recognised patterns (ENOENT, EACCES, ETIMEDOUT, ECONNREFUSED, invalid-url, else other), command = the basename of the spawned command for spawn failures, nothing else. The full text stays local.
• Gated like the rest of the overlay (workspace flag, bound directory, configured credentials); never blocks the turn; a failed post logs once and never surfaces to the user.

Out of scope

Rendering the report anywhere; the backend store (separate change).