test(capabilities): workspace/tooling selftests + live demo fixture (#21)

- mock plumbing cases: workspace path + tools delivered (asserted from
  run-record stderr), host workspace created, absent fields = empty vars
- validation negatives: unknown tool, workspace traversal
- tasks/workspace-demo.json: pi uses bash inside the persistent demo
  workspace; host-visible proof.txt verified live

Closes #21

tasks/workspace-demo.json

@@ -0,0 +1,9 @@
+{
+  "taskVersion": 1,
+  "id": "t-workspace-demo",
+  "prompt": "Use the bash tool to create a file named proof.txt in the current directory containing exactly the text: workspace works. Then reply with exactly: WORKSPACE_OK",
+  "workspace": "demo",
+  "capabilities": { "tools": ["bash", "read", "write"] },
+  "expectExact": "WORKSPACE_OK",
+  "timeoutSeconds": 180
+}