tracking(workspace): complete Gitoxide workspace continuity

## Problem

Maka has several independently verified Gitoxide and workspace-authority
foundations, but Phase 4 workspace continuity is not yet a product capability.
The remaining production composition—trusted packaged helper, state-root-owned
artifacts, filesystem projection, mutation acceptance, restore/rebaseline, and
Desktop/CLI workflows—is described across architecture documents without one
queryable tracker.

This issue tracks that existing Phase 4 route. It must not revive the removed
Git-executable managed-workspace path.

Design sources:

- [Phase 3–4 implementation route](https://github.com/apache/maka/blob/main/docs/architecture/runtime-resume-phase3-phase4-workspace-checkpoint-design.zh-CN.md)
- [Workspace Version Authority v1](https://github.com/apache/maka/blob/main/docs/architecture/runtime-workspace-version-authority-v1.zh-CN.md)
- [Gitoxide repository admission](https://github.com/apache/maka/blob/main/docs/architecture/gitoxide-repository-admission-capability-v1.zh-CN.md)
- [Gitoxide source import](https://github.com/apache/maka/blob/main/docs/architecture/gitoxide-source-import-data-plane-v1.zh-CN.md)
- [Gitoxide candidate/accepted-tree data plane](https://github.com/apache/maka/blob/main/docs/architecture/gitoxide-accepted-tree-data-plane-v1.zh-CN.md)
- [Managed mutation lifecycle authority](https://github.com/apache/maka/blob/main/docs/architecture/runtime-managed-workspace-mutation-lifecycle-authority-v1.zh-CN.md)

Related foundations: #1743, #3561, #3741, and #3857. The retired path was
removed in #4174. Roadmap context: #544 and #2469.

## Current baseline and remaining work

- [x] Persist canonical workspace epoch/version/head facts and rebuildable schema 9 projections (#1743)
- [x] Add bounded Gitoxide helper invocation, repository admission, and fresh source import (#3561)
- [x] Establish managed mutation T1/reservation/successor authority (#3741)
- [x] Add accepted-tree reads and operation-bound immutable candidates (#3857)
- [x] Remove the dormant Git-executable write path (#4174)
- [ ] Bind the helper to a signed packaged-release trust root and protected installation path
- [ ] Add a storage-root-bound destination capability with durable receipt, quarantine, cleanup, and reopen ownership
- [ ] Compose Gitoxide baseline admission with the schema 9 workspace writer
- [ ] Define and enforce `FilesystemMaterializationProfileV1`
- [ ] Bind accepted capability and candidate outcome to mutation T1/T2, then promote or reconcile the accepted ref
- [ ] Reissue capabilities safely after Host restart and recover or collect stale candidates and partial artifacts
- [ ] Bind continuations to accepted workspace versions and implement isolated restore plus durable rebaseline facts
- [ ] Add Desktop/CLI workflows, rollout gates, metrics, and production-shaped platform tests

## Non-goals

- Restoring the old Git CLI adapter or `managed_worktree_v1` profile
- Resetting, cleaning, or overwriting an attached user checkout
- Treating a workspace UUID as proof of file contents
- Claiming unsupported filesystem semantics without a versioned policy
- Automatically retrying side effects whose outcome cannot be proven

Start with the Phase 3–4 implementation route and the linked Workspace Version Authority, repository admission, source import, accepted-tree, and mutation-lifecycle architecture documents. Map one unchecked production-composition item to its existing foundations; completion requires the listed continuity capabilities, Desktop/CLI workflows, rollout gates, metrics, and platform tests without reviving the retired Git CLI path.

Written by the indexing model from the issue text.