test(rust): workspace and hooks coverage — path safety, hook execution, workspace creation

[ridermw]

95%+ coverage on workspace modules. Some already have tests; fill gaps.

Current state

• workspace/mod.rs (108 lines, 5 tests) — create_for_issue, remove_workspace
• workspace/hooks.rs (195 lines, 1 test) — ShellExecutor trait, run_hook, truncate_utf8
• workspace/path_safety.rs (100 lines, 4 tests) — sanitize_key, verify_containment

Tests needed

workspace/mod.rs (add 4+ tests)

• create_for_issue: verify path structure, reuse detection, error on non-dir at path
• remove_workspace: nonexistent path is ok, nested content removed

workspace/hooks.rs (add 8+ tests)

• truncate_utf8: empty, ASCII, multi-byte boundary, exact boundary, longer than max
• run_hook: None hook returns Ok, timeout exceeded, non-zero exit, stderr capture
• PosixShell vs PowerShellExecutor: command formatting

workspace/path_safety.rs (add 4+ tests)

• sanitize_key: dots, slashes, special chars, unicode
• verify_containment: symlink traversal, case sensitivity

Acceptance criteria

• workspace/hooks.rs: 8+ new tests
• workspace/mod.rs: 4+ new tests
• path_safety.rs: 4+ new tests
• truncate_utf8 has full boundary coverage