feat(workspaces): the workspaces switch and its provider instances #451

Problem

The platform chart gains a workspace manager (a new MCP server that owns Organization workspaces, their sync of bare repository mirrors, the person's sign-in to each workspace provider and an RFC 8693 token endpoint), kagent's Session admission by a signed workspace grant, its token broker and the workspace volume reference, all behind one workspaces switch (workspaces design W1, W3, W10). The lab renders none of it, has no provider instance to give the workspace manager, and no place to record a GitHub App of the lab's own for a real provider run. The lab users must also be members of an Organization whose workspaces they manage.

Proposed solution

One PR in internal/config and the values template:

• agentlab configure --workspaces[=false] sets platform.workspaces.enabled (needs agents and the NFS class of feat(workspaces): a read-write-many CSI driver for Substrate mounts #450) and renders the chart's workspaces values: the workspace manager on, workspaces.storage.storageClassName: agentlab-workspaces with no class created by the chart, the Organization lab with the lab's member group, and kagent's admission, broker and volume values the chart derives. The Organization is recorded on each Workspace; every workspace object, volume, sync job and Session lives in the kagent namespace, so no per-Organization namespace is rendered.
• platform.workspaces.provider: fake (the default: the lab's in-cluster GitHub fake as a GitHub Enterprise-shaped provider instance, no account needed) or github (a real GitHub App of the person's own: its App id and client id in agentlab.yaml, the private key and client secret read from sources like githubToken.source and placed as Secrets that the values reference; never in a state file, log or argv). Both may be configured at once, as two provider instances.
• The workspace manager's sign-in callback URL is printed by configure, up and platform, as the Dex callback is for the GitHub sign-in.
• platform-test gains the workspace manager: registered in muster, Ready, list_providers as the admin listing every configured instance.
• docs/workspaces.md: both providers, how to register a GitHub App for the lab (permissions: Metadata read; Contents, Pull requests and Issues read and write; Checks read; user-to-server tokens with expiry; the callback above), and that the lab's Dex sign-in App is a separate App.

Acceptance criteria

• configure --workspaces renders values the platform chart accepts in a dry render, for fake, github and both, naming the agentlab-workspaces class; without the switch the render is unchanged
• On a lab with the switch on, platform-test shows the workspace manager registered, Ready and listing its providers as the admin
• No secret value appears in agentlab.yaml, state/, a log line or a process argv (test over the rendered files)