fix: remove stale {{WORKSPACE_NAME}} directory from container home

Older cached images still contain a literal /home/user/{{WORKSPACE_NAME}}
directory baked in by the previous Dockerfile generation. Even though new
images no longer create it, existing images leave the placeholder folder
alongside the real repo-named mount.

- Add entrypoint cleanup that removes /{{WORKSPACE_NAME}} if it
  exists before creating the real workspace target and /workspace symlink
- Update unit tests to assert the stale placeholder removal

Quality gates:
- pytest tests/unit: 212 passed
- ruff: clean on changed files
- mypy: clean on changed files

apps/api/src/services/build/manifest_compiler.py

@@ -350,6 +350,11 @@ def compile_entrypoint(manifest: dict) -> str:
         lines.append('mkdir -p "$WORKSPACE_TARGET"')
         lines.append('fix_owner "$WORKSPACE_TARGET"')
         lines.append("")
+        lines.append("# Remove stale placeholder directory baked into older images")
+        lines.append('if [ -d "${HOME_DIR}/{{WORKSPACE_NAME}}" ]; then')
+        lines.append('    rm -rf "${HOME_DIR}/{{WORKSPACE_NAME}}"')
+        lines.append('fi')
+        lines.append("")
         lines.append("# Create /workspace compatibility symlink")
         lines.append("# / is owned by root, so we need root or passwordless sudo.")
         lines.append('if [ "$(id -u)" = "0" ]; then')