workspace system facts reach jobcache without public id leakage

Prove the API surface that agents and headless MCP tools rely on stays in step with the browser pipeline: the parity smoke spec exercises every documented op against /api/workspaces, the cutover spec walks an imported legacy workspace, the job-ad role boundary spec pins the public/role split, and the human-cooperation spec confirms agent writes do not race or shadow human edits.