Enforce Gen 2 workspace limits and cleanup

[yousef20920]

Summary

• Cap users at two owned Gen 2 workspaces, enforced transactionally; shared workspaces do not count.
• Prevent workspace creation at the cap and show how to free a slot.
• Make deletion retryable and non-startable while cleaning up; stop the guest and purge saved snapshots before removing the workspace row.
• Preserve the existing six-active-sandboxes-per-host and 15-minute idle hibernation settings.

Verification

• pnpm typecheck
• pnpm test (1,101 passed, 1 skipped)
• pnpm lint
• pnpm build
• cargo fmt --check and cargo clippy passed

Rust unit tests could not link locally because this Mac has not accepted the Xcode license; CI should run them on its runner.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.