fix(workspace): carry v2 bury notes and harden degenerate-shape migration

[Juliusolsson05]

Follow-ups from #1013 review A (persistence). None of these block #1013.

1. Bury notes are dropped. v2's bury prompt stored an optional user-typed note (LegacyBuriedPaneRecord.note, legacyWorkspaceV2.ts:75). legacyMemberships carries only the metadata and buriedAt, so the note is lost on migration. v3 has no parked-note UI, so carrying the text would also need a place to show it; decide the surface first. The owner's own file has 0 buried panes.
2. A v2 file with zero tabs drops its buried rows. The active project becomes '', then undefined, and the rows are dropped (workspaceShape.ts:138-141,165,170). v2 kept buried panes unconditionally.
3. Hand-edited files can unlock autosave over an empty pool. tabs: null, or a non-array projects, migrates to an empty pool; rehydrate then mints a tab and reports complete: true (rehydrate.ts:790-793). v2 threw into the locked fallback instead. The safer rule: an unparseable container is unreadable, never an empty pool.
4. Closing a hibernated terminal leaks its tmux session until the next launch's sweep. killSessionBackendIfOwned (session.ts:129-150) passes no tmuxName. There are more such terminals now, because boot hibernates everything but the focused lane.

Each fix needs a fail-first test on a real recorded document. testing/fixtures/workspace-v2/ and testing/fixtures/worktree-context/ are the corpus.

[Juliusolsson05]

Items 2 and 3 are fixed in #1048. Item 4 (the hibernated terminal's tmux session) is still open, and the naive fix is unsafe — recorded here so the next attempt starts from it.

A first attempt passed the pane's persisted tmuxName to main and killed it when the registry's name prefix matched. Codex review reproduced two problems on an isolated tmux server:

1. A shared prefix is not ownership. An unknown session id and an arbitrary cwd could authorize killing any agentcode-… name, including one minted by a different Agent Code install or an earlier run.
2. tmux targets match as patterns. kill-session -t agentcode- killed a foreign session outright, so a renderer-supplied name is doubly dangerous.

The safe shape, from that review:

• main keeps an authoritative, persisted binding from session id → tmux name, preserved across legitimate restarts, instead of trusting a name the renderer sends;
• the kill enumerates first (as launch reconciliation does) and targets the literal name with tmux's exact-match form (=name);
• the close path proves the binding belongs to THIS install before killing anything.

Item 1 (carrying v2 bury notes) also stays open: v3 still has no parked-note surface, so where the text would be shown is a product decision first.

[Juliusolsson05]

Status after #1048 (merged 46a257f0):

• Item 2 — a v2 file with zero tabs drops its buried rows: FIXED. Migration mints one recovery project for parked rows, and resolves each row's metadata from restoredMeta or sessions (the common shape is buried-and-still-listed, which the first attempt missed). Round-3 review then narrowed the mint to memberships that can actually be re-homed (projectId === null), because a hybrid file — projects: [] beside stale v2 tabs — was minting an empty phantom project and hiding the file from bootstrap's empty-workspace fallback.
• Item 3 — a hand-edited container unlocks autosave over an empty pool: FIXED. A non-array tabs/projects now throws MalformedWorkspaceContainerError, and adoption refuses rather than treating it as an empty workspace.
• Item 4 — a hibernated terminal leaks its tmux session: STILL OPEN. The attempt was reverted during review: kill-session -t agentcode- matches by prefix, not by identity, so it killed a foreign session in the reviewer's isolated test. The safe shape is recorded in the earlier comment on this issue — kill by the session's own recorded tmuxName, never by a pattern, and only when the registry says we own it.
• Item 1 — bury notes: STILL OPEN, and still blocked on the same product call: v3 has no parked-note surface, so carrying the text needs somewhere to show it. The owner's own file has 0 buried panes.