feat(runtime): jjWorkspace — jj/Jujutsu backend for the Workspace port

[drewstone]

What

Adds jjWorkspace — a Jujutsu (jj) backend for the Workspace port, alongside gitWorkspace. Same port, same Shell, same WorkspaceCommit discriminated union — a drop-in. Exported via /loops.

const ws = jjWorkspace({ ref: bareRepo })   // instead of gitWorkspace(...)
await ws.materialize(dir)                    // jj git clone --colocate
await ws.commit(dir, 'msg')                  // describe + new + jj git push → {ok,rev} | {ok:false,conflict}

Why

This finishes the "support jj and any other agent-friendly lightweight versioning" ask. jj suits accumulating, resumable agent loops: no staging area, a first-class operation log (native resume/undo), and conflicts are recorded rather than aborted — a rejected push surfaces as a typed blocker. The port already abstracted the durable store behind a Shell; jj is genuinely a drop-in.

How this unifies the two in-flight branches

I traced the two stalled cherry-picks (feat/observe-closed-loop deep-clean sequence + feat/cloud-loop workspace port) against current main. 3 of the 4 orphan commits were already merged through other PRs, so cherry-picking them was re-applying landed work (the source of the conflicts):

orphan commit	status on main
b3c280c sandbox retry hardenings	already landed (main is ahead — renamed LoopSandboxClient→SandboxClient)
daba562 shared stats.mts + gate dedup	already landed (stats.mts identical; gates ahead via #191 runtimeDecisionPoints)
9838392 steer-firewall dedup + drop analyst-driver-hook	already landed (file deleted, dynamic.ts→driver.ts)
0b110ea Workspace port	partial — jjWorkspace was the one genuine gap

The orphan 0b110ea also regressed the commit type to a looser CommitResult interface (optional rev?/conflict?, allowing an invalid {ok:true}); this PR keeps main's fail-closed WorkspaceCommit union instead.

Test

• pnpm run lint / typecheck / build — clean.
• Full suite: 680 passed, 1 skipped (the jj test skips when the jj binary is absent, e.g. CI; it mirrors the gitWorkspace durable-state-carry contract when jj is present).
• jjWorkspace confirmed exported through dist/loops.d.ts.