Harden Workspace Hub audit and stale-info cleanup

[RichardGeorgeDavis]

Summary

• hardens Workspace Hub local mutating API routes with an explicit intent header and origin guard
• keeps paused Workspace memory/MemPalace actions visibly disabled and API-rejected while the wrapper remains paused
• normalizes repo activity, metadata, and event writes to discovered repo.relativePath values
• removes ServBay-specific tracked docs, setup checks, and Workspace Hub API/UI naming; mapped-host remains a generic preview mode
• updates stale-info guidance so tracked docs/manifests stay canonical over generated cache
• makes tools/scripts/cleanup-sync-noise.sh dry-run by default with explicit --run

Verification

• git diff --check
• git grep -n -i "servbay" HEAD -> no tracked hits
• tools/scripts/cleanup-sync-noise.sh . --all --dry-run -> matched=0
• pnpm --dir repos/workspace-hub typecheck
• pnpm --dir repos/workspace-hub test -> 51 passing tests
• pnpm --dir repos/workspace-hub lint
• pnpm --dir repos/workspace-hub build
• tools/scripts/release-readiness.sh -> pass

Cleanup And Smoke

• Targeted sync-noise cleanup was run before this commit and removed 7,222 .DS_Store, ._*, and Icon\r files.
• Follow-up cleanup dry-run reports matched=0.
• Live Hub smoke verified GET summary/search/capabilities/health endpoints, guarded POST rejection for missing intent and foreign origins, loopback guarded POST success, paused MemPalace context commands, and visible Workspace memory / Workspace Capabilities / Repo Discovery panels.
• Confirmed no dev servers remained on ports 4101 or 4174 after the smoke pass.

Expected Warnings

• tools/scripts/release-readiness.sh reports optional omx missing.