fix(workspace): a corrupt container is not an empty workspace, and a hibernated terminal's tmux dies with it - #1048

…hibernated terminal's tmux dies with it

Three of the four follow-ups filed as #1030 from #1013's persistence
review. Each is a fail-first test against the RECORDED live workspace
(testing/fixtures/workspace-v2), degraded in exactly one field.

1. Item 3 — data loss. A `tabs` or `projects` field that is PRESENT but
   not a list migrated to an empty pool; rehydrate then minted a fresh
   tab and reported `complete`, which unlocks autosave, so the next
   400 ms tick wrote an empty workspace over the real file. v2 threw
   here, and the throw is what puts bootstrap into its locked fallback
   with the disk file untouched. `undefined` stays legal: a v2 file has
   no `projects`, a v3 file has no `tabs`, and `tabs: []` is a writer's
   empty workspace rather than corruption.
2. Item 2 — data loss. A v2 file with zero tabs still carried its buried
   panes, because burial was independent of tabs there. Here every
   session needs a project, so with none left the re-parent target was
   '' and every buried row was dropped — including rows whose only copy
   of the session metadata was the buried record itself. The migration
   now mints one project to receive them, titled from the first such
   session's cwd.
3. Item 4 — resource leak. Closing a hibernated terminal left its tmux
   session running until the next launch's sweep: boot hibernates every
   pane but the focused lane, so main has no row to tear down, and the
   renderer's persisted metadata is the only place the name survives.
   The close now carries `tmuxName`, and main kills it only when the
   registry minted the name (`ownsSessionName`), which is the same
   prefix filter `listManagedSessions` applies.

Item 1 (carrying v2 bury notes) is left open on #1030: v3 has no parked-
note surface, so where the text would be shown is a product decision
rather than a migration fix.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…n it

Round-2 review finding. The recovery mint fired for ANY parked membership,
but a minted project only ever receives rows that re-parent into it — and
only a membership whose own project is gone (`projectId: null`) does that.
A membership naming a live v2 tab keeps that name, which is not a project id,
so it is dropped further down no matter what we mint.

The shape that exposed it is a hybrid file: `projects: []` beside stale v2
tabs and their sessions. Migration minted a project, then dropped every
session, leaving an empty nameless project — and a file with one project no
longer looks empty to bootstrap, so the user lost the first-run path as well.

The new test builds that hybrid from the recorded live workspace and fails
without the restriction.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>