fix(workspaces): validate prospective child source trust

Pass server-owned creation context before the child is saved. Validate the
creator run, sponsor and parent ancestry against the immutable boundary,
then verify current parent and prospective child policies. Preserve exact
saved task identity for ordinary selection and writes.

Add real database and authenticated HTTP regressions, including omitted
client policy, and update the plan and paired workspace maps.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

maps/feature-map/workspaces.md

@@ -53,6 +53,8 @@ provision script must not run on the host during fresh creation, reuse, or rebui
 Verify the adapter still selects the sandbox and ordinary trusted provisioning
 continues to work.
 
+For a child created by an admitted agent with an explicit existing workspace, verify that a matching sandbox boundary permits creation before the child has an ID. A changed child policy, unrelated parent, or forged creator run must fail. See the [child workspace trust regression](../../server/src/__tests__/task-workspace-child-trust.test.ts). This automated contract does not add live acceptance evidence.
+
 ### `workspace-management`
 
 Automated: [workspace detail](../../ui/src/pages/ExecutionWorkspaceDetail.test.tsx) and [runtime service](../../server/src/__tests__/workspace-runtime.test.ts) cover UI and runtime contracts separately.