feat(web): add workspace change review

[627150795]

Problem

The Web UI does not expose the current Session workspace's Git changes, so users cannot review modified, deleted, untracked, or binary files from the active workspace. Closes #536.

Value

Users can understand workspace state and inspect bounded file-level diffs without leaving the Web UI. The view is read-only and scoped to the active Session.

Approach

• Add a Session-bound GET /api/workspace-changes endpoint that discovers the repository, compares against the current HEAD (or the empty tree when there is no HEAD), and computes bounded per-file diffs.
• Report explicit clean, non-repository, unavailable, binary, truncated, and untracked states.
• Add a Web UI view with refresh, file status/stat summaries, and selected-file diff details.
• Bound file count and diff sizes, and abort Git reads when the request is no longer active.
• Rebased the feature commit onto upstream main at f6b49ae59605b1276b8267f2886d22c03f01533c; final candidate SHA is a64702220cda33bf0267d002fe4f08c3d6f38953.

Validation

• node --test --experimental-strip-types tests/web/workspace-changes.test.ts — 2 passed.
• node --test --experimental-strip-types --test-name-pattern="Session-bound workspace changes" tests/web/web-host.test.ts — 1 passed.
• bunx vitest run tests/web/app-render.spec.ts tests/web/web-store.spec.ts tests/web/web-protocol.spec.ts — 159 passed.
• bun run check — passed: contracts, UI/root type checks, format, lint, and production Web build.
• bun run test:web:e2e — 33 passed, 1 failed in the pre-existing delayed workspace-creation receipt test; the target unknown-admission test passed at the final SHA. The original CI failure (Response has been disposed in that target test) was reproduced from the recorded CI log, but not locally; the same target test passed 30 times on the PR head and 10 times on its parent.
• bun run test — 1,564 tests reported, 1,554 passed, 0 test-level failures, 10 skipped; the runner also reported the unrelated optional background-terminal deadline process-tree failure. The full suite is therefore not a clean green gate.

Impact

• User-visible behavior: adds a read-only Workspace Changes view.
• Model-visible context/tools: None.
• Runtime/lifecycle: adds bounded Git reads for the active Web Session; no write, stage, or commit operations.
• Persisted config/data: None.
• Compatibility or risk: non-Git workspaces and Git errors are reported explicitly; diff/file output is bounded. No functional code change was made for the unrelated CI E2E failure because the affected test predates this PR and is unchanged by its diff.