Advance the task CAS revision when accepting a pending workspace choice so
superseded retries cannot replace newer intent. Preserve active run roots.
Validate physical source trust before copying, admission and publication,
including retained readers and standard runs without a saved policy. Defer
isolation proof until all checks pass. Disable configured and builtin host
provisioning for low-trust sandbox worktree creation, reuse and rebuild.
Recognize primary separate Git storage without probing unrelated company
history, and document workspace run-log measurements and policy semantics.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
