Make project identity host-owned and add explicit project tags

[xai]

What it does

Closes #19.

The project namespace selects config, secrets, generated files, skills, caches,
network state, and cleanup scope. On main, checkouts with a real .git
directory still asked Git for the path to hash. A crafted commondir could
therefore select another project's persisted state, and Git could report
different path casing on case-insensitive filesystems. Linked worktrees already
skipped that lookup and used their own paths, but there was no explicit way for
separate checkouts to share a namespace.

This PR makes the fallback namespace a hash of the canonical directory path and
adds an explicit host-side override:

• ~/.config/enclave/project-tags.json maps exact canonical directories to a
  named tag and shared namespace. The host-owned registry is never mounted into
  a container and is rejected when malformed or unsafe.
• enclave project tag set|unset|list and project show expose the workflow.
  Creating or joining a tag requires confirmation unless --yes is used.
  Joining lists the complete shared scope; --new and --existing pin intent.
  list and show also provide documented JSON output.
• The first member keeps its path-derived namespace as the namespace origin.
  Later members switch to it, leaving their previous data dormant. Tag
  operations do not copy, merge, or delete project data, and the origin cannot
  be removed while other members remain.
• Stores, labels, network and lifecycle operations, cleanup, and Theia
  preferences now use the effective namespace. A backend-neutral lifetime
  lease protects each writable config store; detached Docker sessions transfer
  that lease to a host monitor, while a QEMU collision is rejected before store
  preparation.

The worktree-specific config-store suffix and the Git worktree helper package
are removed. User documentation and architecture notes now describe tag
semantics and the JSON integration contract.

How to test

cd ~/src/foo-main
enclave project tag set foo

cd ~/src/foo-feature
enclave project show                  # own path-derived namespace
enclave project tag set foo       # lists and confirms the shared scope
enclave project show --json           # effective namespace now matches main

Follow-ups

• Dormant fallback data is reported but cannot be listed or pruned through the
  CLI.
• Tag operations affect future invocations only. Running sessions keep the
  namespace, mounts, and labels they started with.
• Membership is path-based, so renaming a directory drops the tag.
• A backend-neutral lease-based suffix allocator could allow concurrent unnamed
  persistent sessions when a backend cannot select another store key.

Breaking changes

• This PR introduces breaking changes and has been coordinated with maintainers.

• Main-worktree checkouts whose Git-reported path spelling differs from the
  canonical input path derive a new namespace on case-insensitive filesystems.
  There is no migration. Linked worktrees and matching path spellings keep
  their existing namespaces.

• A second persistent QEMU session on the same config-store key now fails
  instead of proceeding.

• internal/theia: LoadPreferences is replaced by the namespace-keyed
  LoadPreferencesForProject; Effective, GlobalPreferences, and
  ProjectPreferences are removed without replacements. Internal API only, no
  external contract.

Review checklist

• As an author, I have thoroughly tested my changes and carefully followed the contribution guidelines.