fix: avoid literal {{WORKSPACE_NAME}} directories in built images

When a manifest mount target uses ~/{{WORKSPACE_NAME}}, the Dockerfile was
building a literal directory named {{WORKSPACE_NAME}} into the image and
creating a broken /workspace symlink. The runtime mount then created the
correct repo-named folder alongside the placeholder folder.

- Only create static mount target directories in the Dockerfile; skip any
  target containing {{WORKSPACE_NAME}}
- Only create the /workspace compatibility symlink at image-build time when
  the workspace name is known; otherwise let the entrypoint create it from
  the WORKSPACE_NAME environment variable
- Update unit tests to cover both build-time workspace names and runtime
  placeholders

Quality gates:
- pytest tests/unit: 211 passed
- ruff: clean on changed files
- mypy: clean on changed files

.pi-map.index.md

@@ -16,7 +16,7 @@ dir: .
 Trust boundary: index routes, map orients, source decides.
 
 ## role
-A self-hosted web-based project management and git repository platform with OAuth2 SSO authentication, containerized for Docker deployment.
+Infrastructure and deployment configuration package for a self-hosted project management platform with containerized services, SSO integration, and reverse proxy support.
 ## parent
 -
 ## children
@@ -69,7 +69,6 @@ A self-hosted web-based project management and git repository platform with OAut
 - CHANGELOG.md
 - Makefile
 - README.md
-- context.md
 - docker-compose.traefik.yml
 - docker-compose.yml
 - progress.md