fix: persist writable contexts in workspace scope

[federicodeponte]

Summary

• preserve the active workspace scope across run execution, E2B context upload/writeback, and agent context staging/writeback
• stop replacing the workspace scope with an account-derived scope inside nested runtime boundaries
• stop logging durable context persistence as successful when the remote refresh hook raises

Root cause

Cloud binds each run to its workspace before entering the engine. The engine then nested use_context_scope(context_scope_for_user(owner_id)) calls in run service and both runtime paths. Those calls replaced the active workspace with the account ID. Writable context files were therefore synchronized under an account-prefixed storage key while the context viewer and workspace operations read the workspace-prefixed key.

Verification

• new cross-worker regression failed before the fix because the canonical workspace file remained stale; passes after the fix and proves writer and reader workers exchange the updated file through only the workspace tree
• new durable-sync failure regression failed before the fix because both failure and success were logged; passes after the fix and proves no persistence success is emitted after refresh failure
• python3 -m pytest -q tests/test_e2b_artifact_collection.py: 32 passed
• relevant agent, capability, memory, and worker-context suites: 34 passed
• ruff check .: passed
• python3 -m compileall on changed Python files: passed

Safety review

• workspace scope comes only from the existing validated resolver and ContextVar
• account fallback behavior is unchanged when no workspace is bound
• context-name validation and containment checks are unchanged
• no customer identifiers or production data are included in this PR

Related read-path PR #2263 does not overlap this writeback scope fix.