Workspace attach: post a sanitized session attach report to the backend when the outcome settles

## Problem

When a workspace attach settles, the CLI is the only place that knows what the session actually received: which declared tool keys the engine served, which it could not and why (the engine's unfulfilled-keys report), the engine and CLI versions, whether a VS Code bridge was live — or that the engine was missing, too old, or failed to start. None of that reaches the backend, so the workspace page cannot show "your last session received …" or whether a linked project is ready.

## Proposal

After the outcome settles in the attach path (`engine-overlay.ts`), post one **session attach report** to `POST /datamates/{id}/attach-reports` through the existing API client, fire-and-forget with a bounded timeout, once per announcement signature (the same dedupe the toast uses). Failed outcomes post too.

- Report: outcome kind; the binding identity the server row already holds (git remote, else project path); CLI version; engine version (null when missing); bridge state; declared and delivered keys; the engine's report; a timestamp.
- **Sanitize before sending.** Engine `detail` strings are raw error text and can contain paths or hosts. Reduce each to `{code, command?}` — `code` from recognised patterns (`ENOENT`, `EACCES`, `ETIMEDOUT`, `ECONNREFUSED`, `invalid-url`, else `other`), `command` = the basename of the spawned command for spawn failures, nothing else. The full text stays local.
- Gated like the rest of the overlay (workspace flag, bound directory, configured credentials); never blocks the turn; a failed post logs once and never surfaces to the user.

## Out of scope

Rendering the report anywhere; the backend store (separate change).