CLI --workspace flag should override agent-config.yaml workspace

Problem

Workspace resolution in internal/cmd/serve.go (resolveWorkspace) uses the precedence:

agent-config.yaml > --workspace flag > default

This is backwards from the standard convention (CLI flag > env > config > default). When a user passes --workspace /tmp/test-workspace but the packaged agent-config.yaml hardcodes workspace: /tmp/standalone-agent, the flag is silently ignored and file tools are confined to the wrong directory.

Discovered while manually testing PR #102 (see scratch/phase2-manual-testing.md).

Context

• workspace in agent-config.yaml is part of the agent's packaged definition (ships with the image/K8s manifests).
• --workspace is an operational override and should win when explicitly set.
• Pre-existing issue from #98 (make workspace path configurable via CLI flag), not introduced by #102.

Proposed fix

Flip precedence in resolveWorkspace:

func resolveWorkspace(cfgWorkspace, flagWorkspace string) string {
	if v := strings.TrimSpace(flagWorkspace); v != "" {
		return v
	}
	if v := strings.TrimSpace(cfgWorkspace); v != "" {
		return v
	}
	return defaultWorkspace
}

Acceptance criteria

• Explicit --workspace flag overrides agent-config.yaml workspace.
• Config value still used when flag is empty.
• Default /workspace used when neither is set.
• Update docs/tests accordingly (incl. the note in scratch/phase2-manual-testing.md).

Start in internal/cmd/serve.go at resolveWorkspace and review the workspace resolution paths and related tests. Check the note in scratch/phase2-manual-testing.md, then update the documentation and tests so explicit --workspace, config workspace, and the /workspace default are each verified.