fix: remove stale {{WORKSPACE_NAME}} directory from container home

Older cached images still contain a literal /home/user/{{WORKSPACE_NAME}}
directory baked in by the previous Dockerfile generation. Even though new
images no longer create it, existing images leave the placeholder folder
alongside the real repo-named mount.

- Add entrypoint cleanup that removes /{{WORKSPACE_NAME}} if it
  exists before creating the real workspace target and /workspace symlink
- Update unit tests to assert the stale placeholder removal

Quality gates:
- pytest tests/unit: 212 passed
- ruff: clean on changed files
- mypy: clean on changed files

apps/api/tests/unit/test_manifest_compiler.py

@@ -112,9 +112,7 @@ class TestCompileDockerfileHomeDirectory:
             "interface_type": "terminal",
             "home_directory": "/home/custom",
             "user": {"name": "dev", "uid": 1000, "gid": 1000},
-            "mounts": [
-                {"source_type": "repo", "target": "~/{{WORKSPACE_NAME}}"}
-            ],
+            "mounts": [{"source_type": "repo", "target": "~/{{WORKSPACE_NAME}}"}],
         }
         dockerfile = compile_dockerfile(manifest)
 
@@ -315,6 +313,19 @@ class TestCompileEntrypoint:
         assert 'ln -sfn "$WORKSPACE_TARGET" /workspace' in entrypoint
         assert 'WORKSPACE_NAME="${WORKSPACE_NAME:-workspace}"' in entrypoint
 
+    def test_entrypoint_removes_stale_placeholder_directory(self) -> None:
+        """Older images baked in a literal {{WORKSPACE_NAME}} directory."""
+        manifest = {
+            "base_image": "ubuntu:24.04",
+            "interface_type": "terminal",
+            "home_directory": "/home/custom",
+            "user": {"name": "dev", "uid": 1000, "gid": 1000},
+        }
+        entrypoint = compile_entrypoint(manifest)
+
+        assert 'if [ -d "${HOME_DIR}/{{WORKSPACE_NAME}}" ]; then' in entrypoint
+        assert 'rm -rf "${HOME_DIR}/{{WORKSPACE_NAME}}"' in entrypoint
+
     def test_entrypoint_uses_root_then_sudo_for_workspace_symlink(self) -> None:
         """/workspace is under /, so root takes precedence; non-root falls back to sudo."""
         manifest = {