feat(workspaces): introduce runtime execution boundary

Establish the pipe-mode vertical slice before migrating terminals, files, Git, and providers. Runtime selection is immutable per workspace, and external runtimes remain unavailable to path-based daemon surfaces until those capabilities move behind the boundary.

.github/workflows/docker.yml

@@ -16,6 +16,7 @@ on:
       - "packages/app/**"
       - "packages/cli/**"
       - "packages/client/**"
+      - "packages/docker-workspace-runtime/**"
       - "packages/expo-two-way-audio/**"
       - "packages/highlight/**"
       - "packages/protocol/**"
@@ -155,6 +156,29 @@ jobs:
           cache-from: type=gha,scope=paseo
           cache-to: type=gha,scope=paseo,mode=max
 
+  workspace-runtime-test:
+    needs: setup
+    if: needs.setup.outputs.publish != 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: node scripts/npm-retry.mjs ci
+
+      - name: Build server dependencies
+        run: npm run build:server-deps
+
+      - name: Test workspace runtime contract
+        run: npm run test:workspace-runtime:docker --workspace=@getpaseo/server
+
   publish:
     needs: setup
     if: needs.setup.outputs.publish == 'true'