fix(workspace): support v4 multi-repository member additions

[Ldsystem]

Problem

add-workspace-member rejects every metadata-v4 multi-repository workspace, although this is the recommended non-Git workspace layout. The implementation assumes a composite root source at preflight, proposal, publication and replay, leaving no supported lifecycle for adding another source.

Change

Make the existing lifecycle mode-aware. Multi-repository additions retain their mode and direct member-name binding, use device-local managed-worktree observations, and do not create a root Git repository or composite exclusions. Verify existing required members, checkout/Git-store containment, branch, remote and cleanliness before publication. Preserve adoption versus transaction-owned clone rollback and verified no-op replay. Keep single/composite behavior.

Append repository metadata within its owning YAML block even when optional fields are absent or unrelated top-level fields follow it. Update lifecycle guidance and add isolated regression coverage for adoption, replay, collisions, stale proposals, unsafe paths, invalid bindings and rollback.

Validation

• RED: new valid-add tests failed at the existing mode rejection.
• Focused multi-member and existing v4 suite: 96 passed.
• Full pinned Python 3.13 / pytest 9.1.1 suite: 690 passed.
• git diff --check and bin/work-bundle-skill validate passed.
• Skill scenarios added; no automated model-harness execution is claimed.

All tests use isolated synthetic workspaces and local fixture remotes. No next-generation MCP implementation is included.

Independent read-only review accepted the exact committed patch with no findings.
The reviewer assessed safety, rollback ownership, compatibility and test oracles;
its skill-scenario assessment was reasoning-only, not an executed model harness.

[Ldsystem]

An additional independent agent review of merge commit 6f90ce78b7362c39c8f765c7b50559ad3f78f466 returned repair with two confirmed correctness findings:

• P1: A quoted top-level YAML key following source_repositories is missed as a section boundary. Member insertion can publish invalid YAML while reporting success.
• P2: An inline comment on the source_repositories header raises an uncaught StopIteration. Reproduced for both single- and multi-repository inputs.

Both were reproduced with public CLI regression tests before repair. A follow-up PR is being prepared with boundary-preserving insertion, target validation, and dependency-free runtime coverage. The prior plain-header live registration remains valid; this review corrects the earlier broader acceptance claim.

This is a report of an independent agent's review, posted by the PR author, not a separate GitHub account approval.