Add local Workspace Operations contract surfaces to sourceos-shell

[Copilot]

sourceos-shell needs to surface and control local Workspace Operations (sync, terminal, browser, agent-machine, model carry, workstation state) while remaining a pure projection/control layer — no Policy Fabric ownership, no Operation Plane runtime logic.

Contracts (schemas)

• workspace-operation-state.schema.json — read-only projection the shell renders from Operation Plane state. Covers all required lifecycle states (stored → quarantined → admitted → activated → syncing → conflicted → failed), file availability states (local, remote, syncing, conflicted, quarantined), device identity/trust profile, sourceos-syncd sync status, TurtleTerm/BearBrowser/agent-machine entry points, and Operation Tray/Inspector projection metadata.
• operation-command.schema.json — structured record the shell emits to route actions through the Operation Plane (never executes integrations directly). Command classes: turtleterm-open/close, bearbrowser-open/close, agentmachine-activate/deactivate, sync-request/cancel, diagnostics-export, model-carry-initiate, workstation-state-query. Includes isDryRun for plan/preview.
• diagnostics-export.schema.json — redacted diagnostics export; redactionApplied: true and contentCaptureEnabled: false are schema-enforced invariants.

Examples (examples/workspace-ops/)

Eight example fixtures covering the full state space: admitted/syncing, conflicted, and quarantined operation states; turtleterm-open, sync-request, and agentmachine-activate commands; redacted and metadata-only diagnostics exports.

Validation & CI

scripts/validate_workspace_ops.py (mirrors validate_ops_history_receipts.py) validates all examples against their schemas and enforces domain invariants (policyDecisionRefs non-empty, redactionApplied: true, etc.). .github/workflows/workspace-ops.yml runs it on every relevant path change.

Docs

docs/workspace-operations.md captures boundary rules, surface-to-schema mapping, full state/command-class tables, and integration refs — matching the style of docs/ops-history-receipts.md.