Fix autocommit exclude leak during final squash

[cursor]

Summary

• Fix commit_workspace_on_done so configured symphony.autocommitExclude paths from earlier wip: commits do not survive in the final squash commit.
• Add a regression test covering an excluded path committed before final auto-commit.

Type

• Bug fix
• Feature
• Docs
• Tests or tooling
• Refactor

Verification

Paste the commands you ran and the result.

/tmp/symphony-venv/bin/python -m pytest tests/test_workspace.py -q
# 28 passed in 4.23s

/tmp/symphony-venv/bin/python -m pytest tests/test_orchestrator_dispatch.py -q
# 71 passed in 1.37s

/tmp/symphony-venv/bin/python -m pytest -q
# 529 passed, 5 skipped in 25.94s

For workflow/service/board changes:

# Not run; change is limited to workspace auto-commit behavior and covered by pytest.

Risk Notes

• Root cause: the final auto-commit staged exclude-aware paths before git reset --soft, so index entries from prior wip: commits under excluded paths stayed staged and leaked into the final ticket commit.
• Fix: detect the recorded-base squash first, reset the index/worktree view with git reset --mixed "$BASE", then run the existing exclude-aware git add before committing.
• Risk is limited to final auto-commit squashing; legacy no-base commit behavior still uses the same final staging path.

Checklist

• This PR targets dev.
• I added or updated tests for behavior changes.
• I updated docs/examples for user-facing changes.
• I did not commit secrets, logs, local run state, virtualenvs, or generated artifacts.
• CI is green or I explained any expected failure above.