feat(workspace): WorkspaceContext + SessionWorkspaceBoundEvent foundation

Add a WorkspaceContext value type and a nullable OrchestrationConfig.workspace,
plus SessionWorkspaceBoundEvent registered in eventModule. Purely additive; no
behavior change when workspace is null. (Axis 2 Phase A, tasks 1-2.)

core/kernel/src/main/kotlin/com/correx/core/kernel/orchestration/OrchestrationConfig.kt

@@ -10,4 +10,5 @@ data class OrchestrationConfig(
     val stageTimeoutMs: Long = 60_000L,
     val sandboxRoot: Path = Path.of(System.getProperty("java.io.tmpdir"), "correx-sandbox"),
     val defaultSystemPromptPath: String? = null,
+    val workspace: WorkspaceContext? = null,
 )

core/kernel/src/main/kotlin/com/correx/core/kernel/orchestration/WorkspaceContext.kt

@@ -0,0 +1,10 @@
+package com.correx.core.kernel.orchestration
+
+import java.nio.file.Path
+
+data class WorkspaceContext(
+    val workspaceRoot: Path,
+    val workingDir: Path,
+    val allowedPaths: Set<Path>,
+    val privilegedLocations: List<Path> = emptyList(),
+)