fix: chown workspace parents on create for bind-mode sibling clone

[wcgomes]

Problem

Bind-mode postCreateCommand sibling clone failed with Permission denied when the workspace root /workspaces is root-owned — the sibling clone cannot create its directory under a non-writable parent.

Fix

Parents-only rootfs fix-up on the create paths of up, clone, and rebuild:

• WorkspaceOwnership gains a parentsOnly scope — chowns only the parent directories of the workspace path, never the bind target itself
• No-op when the owner is root or unset
• clone is covered by the existing rootfs walk

Spec

• specs/changes/workspace-parents-writable/ (proposal, spec, tasks)

Tests

• swift build clean
• 857 passed / 0 failed / 15 skipped on Linux (integration tests skip by design)

Wiki

• wiki/domain/devcontainer-apple-gaps.md
• wiki/conventions/cli-runtime-boundary.md