fix: use sudo/root to create /workspace symlink in manifest entrypoint

The previous commit moved the pi-agent repo mount from /workspace to
/home/user/{repo_name}. This exposed a permission bug: the Dockerfile
creates /workspace as a root-owned symlink in the image, and the
non-root entrypoint could not replace it because / is owned by root.

- Update compile_entrypoint to recreate /workspace via sudo when running
  as the container user, or directly when running as root
- Add unit test covering sudo/root symlink creation
- Update OpenSpec change docs with the additional root cause

Quality gates:
- pytest tests/unit: 208 passed
- ruff: clean on changed files
- mypy: clean on changed files
- alembic heads: single head

openspec/changes/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: openspec/changes
 
 ## role
-Manages change tracking and versioning for OpenAPI specification modifications
+Manages and tracks specification changes, diffs, and versioning history for OpenAPI documents.
 ## parent
 index: openspec/.pi-map.index.md
 map: openspec/.pi-map.md