fix(server): correct pause-reason labels (S7) + bind workspace on REST launch (S8)

S7: DomainEventMapper mapped every non-APPROVAL_PENDING pause (CLARIFICATION_PENDING,
ABANDONED_STALE) to USER_REQUESTED, so clients rendered the wrong pause state. Added
the two PauseReason enum values, mapped the real reason string, and gave the Go TUI
distinct labels.

S8: REST POST /sessions launched a run without resolving/recording a workspace, so the
session had no SessionWorkspaceBoundEvent (path containment, project profile, grants had
nothing to anchor to). Extracted the WS path's resolve+emit into ServerModule.bindWorkspace
and called it from both launchers.

apps/tui-go/internal/app/server.go

@@ -120,8 +120,13 @@ func (m *Model) applyServer(msg protocol.ServerMessage) {
 		}
 	case protocol.TypeSessionPaused:
 		label := "PAUSED"
-		if msg.Reason == "APPROVAL_PENDING" {
+		switch msg.Reason {
+		case "APPROVAL_PENDING":
 			label = "PAUSED awaiting approval"
+		case "CLARIFICATION_PENDING":
+			label = "PAUSED awaiting answer"
+		case "ABANDONED_STALE":
+			label = "PAUSED (stale)"
 		}
 		m.touch(msg.SessionID, label)
 		if s := m.session(msg.SessionID); s != nil {