fix: make workspace initialization parallel-safe

[AjnasNB]

What changed

• make workspace initialization idempotent with initializeWorkspace({ ifNeeded: true }) and qarinah init --if-needed
• make simultaneous local workers converge on one workspace identity
• write the workspace config last as the readiness marker and refuse unsafe partial ledgers
• keep nested worker discovery on the same authorized ancestor workspace
• document the Agent A to Agent B handoff, SQLite WAL read model, and serialized authoritative append boundary
• regenerate the bundled Codex and Claude runtimes

Root cause

Setup treated an already-created workspace as an error and multiple initializers could race while creating .qarinah. A global install also does not authorize a repository: Qarinah intentionally requires explicit per-workspace consent.

Impact

A setup command may now be started safely by parallel workers. After one explicit setup at the project root, workers started in descendant folders discover the same workspace, ledger, derived graph, and SQLite read model. A conflicting capture mode fails closed.

Validation

• full npm run check passed
• 133 Node tests passed
• 12 parallel initializers converged on one workspace ID
• nested Agent B retrieved Agent A's exact event ID and hash
• SQLite journal mode verified as WAL with matching event count
• 24 in-process and 32 cross-process concurrent appends preserved one valid hash chain
• Codex and Claude MCP smoke tests passed
• docs/site build and 22-route verification passed
• TypeScript consumer, clean packed consumer, benchmarks, CodeQL-oriented checks, and npm tarball validation passed