fix: use sudo/root to create /workspace symlink in manifest entrypoint

The previous commit moved the pi-agent repo mount from /workspace to
/home/user/{repo_name}. This exposed a permission bug: the Dockerfile
creates /workspace as a root-owned symlink in the image, and the
non-root entrypoint could not replace it because / is owned by root.

- Update compile_entrypoint to recreate /workspace via sudo when running
  as the container user, or directly when running as root
- Add unit test covering sudo/root symlink creation
- Update OpenSpec change docs with the additional root cause

Quality gates:
- pytest tests/unit: 208 passed
- ruff: clean on changed files
- mypy: clean on changed files
- alembic heads: single head

apps/api/tests/unit/test_manifest_compiler.py

@@ -250,6 +250,20 @@ class TestCompileEntrypoint:
         assert 'ln -sfn "$WORKSPACE_TARGET" /workspace' in entrypoint
         assert 'WORKSPACE_NAME="${WORKSPACE_NAME:-workspace}"' in entrypoint
 
+    def test_entrypoint_uses_sudo_for_workspace_symlink(self) -> None:
+        """/workspace is under /, so the non-root entrypoint needs sudo to recreate it."""
+        manifest = {
+            "base_image": "ubuntu:24.04",
+            "interface_type": "terminal",
+            "home_directory": "/home/custom",
+            "user": {"name": "dev", "uid": 1000, "gid": 1000},
+        }
+        entrypoint = compile_entrypoint(manifest)
+
+        assert 'if [ -n "$SUDO" ]; then' in entrypoint
+        assert 'sudo ln -sfn "$WORKSPACE_TARGET" /workspace' in entrypoint
+        assert 'elif [ "$(id -u)" = "0" ]; then' in entrypoint
+
     def test_entrypoint_fixes_mount_owners(self) -> None:
         manifest = {
             "base_image": "ubuntu:24.04",