Bolt workspaces command to only run on modified workspaces

It would be great, for CI/CD and pre-commit hooks, if I could run `bolt ws --only-modified` such that, only if there were changes in the workspaces subdirectory, would the command run on that particular workspaces.

This would be useful especially for doing things like running a `lint` command only on the packages that need it.

Start by locating the implementation of `bolt ws` and its workspace-selection path; the issue names no file or test. Trace how workspace subdirectories and commands are selected, then verify that `--only-modified` runs the command only for workspaces with changes, including the lint use case described.

Written by the indexing model from the issue text.