refactor: store workspaces as {workspace_id}/{repo_name} for natural git clone layout

Working copies were stored as /data/working-copies/{repo_id}/{workspace_name}/,
so git clone was forced into a user-named directory. That meant the container
mount basename was the workspace name (e.g. main) instead of the repo name.

- Generate the workspace UUID before cloning and clone into
  /data/working-copies/{workspace_id}/ so git creates {repo_name}/ naturally
- Set workspace.path to /data/working-copies/{workspace_id}/{repo_name}/
- Update _migrate_clone_into_workspace() to use the same layout
- _get_repository_mount_name() now prefers workspace.path basename and only
  falls back to remote URL / repo.name for legacy repo-only instances
- Update unit tests to assert workspace path basename is used for mounts

Quality gates:
- pytest tests/unit: 219 passed
- ruff: clean on changed files
- mypy: clean on changed files

openspec/changes/fix-pi-container-mount-permissions/tasks.md

@@ -6,6 +6,7 @@
 - [x] Update instance_service.py to pass REPO_NAME/WORKSPACE_NAME
 - [x] Remove explicit repo mount from pi-agent manifest; synthesize mount in compile_compose
 - [x] Add _get_repository_mount_name() helper to derive workspace name from remote URL
+- [x] Switch workspace storage layout to /data/working-copies/{workspace_id}/{repo_name}/
 - [x] Update unit tests
 - [x] Run quality gates (pytest unit, ruff, mypy)
 - [ ] Commit and push