Harden trusted application workspace edge scope

[jonathanhaaswriter]

Summary

• reject provider-projected application_workspace_id fields before generic Rust graph mapping
• preserve the trusted typed Neo4j relationship workspace through legacy ContextEdge reads and fail closed on conflicting or invalid metadata
• align Go configuration, Go projection, and Rust legacy projection workspace identifiers to the shared 128-byte contract

Validation

• go test ./internal/config ./internal/ports -count=1
• cargo test -p cerebro-source-runtime-next -p cerebro-organizational-store -p cerebro-platform
• cargo test -p cerebro-organizational-store
• cargo clippy -p cerebro-source-runtime-next -p cerebro-organizational-store -p cerebro-platform --all-targets -- -D warnings
• cargo fmt --all --check
• make lint-shard LINT_PACKAGES="./internal/config ./internal/ports" LINT_SHARD_TOTAL=1 LINT_SHARD_INDEX=0
• make check-structural check-arch