fix: avoid literal {{WORKSPACE_NAME}} directories in built images

When a manifest mount target uses ~/{{WORKSPACE_NAME}}, the Dockerfile was
building a literal directory named {{WORKSPACE_NAME}} into the image and
creating a broken /workspace symlink. The runtime mount then created the
correct repo-named folder alongside the placeholder folder.

- Only create static mount target directories in the Dockerfile; skip any
  target containing {{WORKSPACE_NAME}}
- Only create the /workspace compatibility symlink at image-build time when
  the workspace name is known; otherwise let the entrypoint create it from
  the WORKSPACE_NAME environment variable
- Update unit tests to cover both build-time workspace names and runtime
  placeholders

Quality gates:
- pytest tests/unit: 211 passed
- ruff: clean on changed files
- mypy: clean on changed files

apps/api/tests/unit/test_manifest_compiler.py

@@ -91,16 +91,35 @@ class TestCompileDockerfileHomeDirectory:
         assert "WORKDIR /home/custom" in dockerfile
 
     def test_workspace_symlink_created(self) -> None:
+        """When workspace name is known at build time, create /workspace symlink."""
         manifest = {
             "base_image": "ubuntu:24.04",
             "interface_type": "terminal",
             "home_directory": "/home/custom",
+            "workspace_name": "my-app",
             "user": {"name": "dev", "uid": 1000, "gid": 1000},
         }
         dockerfile = compile_dockerfile(manifest)
 
         assert "mkdir -p /home/custom" in dockerfile
-        assert "ln -sfn" in dockerfile
+        assert "ln -sfn /home/custom/my-app /workspace" in dockerfile
+
+    def test_runtime_workspace_not_baked_into_image(self) -> None:
+        """When workspace name is a runtime placeholder, do not create literal
+        {{WORKSPACE_NAME}} directories or symlinks in the image."""
+        manifest = {
+            "base_image": "ubuntu:24.04",
+            "interface_type": "terminal",
+            "home_directory": "/home/custom",
+            "user": {"name": "dev", "uid": 1000, "gid": 1000},
+            "mounts": [
+                {"source_type": "repo", "target": "~/{{WORKSPACE_NAME}}"}
+            ],
+        }
+        dockerfile = compile_dockerfile(manifest)
+
+        assert "{{WORKSPACE_NAME}}" not in dockerfile
+        assert "ln -sfn" not in dockerfile
 
     def test_runtime_working_dir_overrides_home_workdir(self) -> None:
         manifest = {