fix: avoid literal {{WORKSPACE_NAME}} directories in built images

When a manifest mount target uses ~/{{WORKSPACE_NAME}}, the Dockerfile was
building a literal directory named {{WORKSPACE_NAME}} into the image and
creating a broken /workspace symlink. The runtime mount then created the
correct repo-named folder alongside the placeholder folder.

- Only create static mount target directories in the Dockerfile; skip any
  target containing {{WORKSPACE_NAME}}
- Only create the /workspace compatibility symlink at image-build time when
  the workspace name is known; otherwise let the entrypoint create it from
  the WORKSPACE_NAME environment variable
- Update unit tests to cover both build-time workspace names and runtime
  placeholders

Quality gates:
- pytest tests/unit: 211 passed
- ruff: clean on changed files
- mypy: clean on changed files

apps/api/src/services/instance/health_monitor.py

@@ -292,9 +292,8 @@ class HealthMonitor:
                 return
             # Skip "not_found" errors for containers that were never running
             # (e.g. still starting, or intentionally stopped/deleted).
-            if (
-                snapshot.container_status == "not_found"
-                and (previous is None or previous.container_status != "running")
+            if snapshot.container_status == "not_found" and (
+                previous is None or previous.container_status != "running"
             ):
                 return
             category = "instance"