Restore the legacy Dojo workspace marker

[zardus]

Summary

• recreate /run/dojo/sys/workspace/privileged for local pwnshop workspaces
• expose the legacy standard-workspace value zero plus newline with mode 0444
• keep workspace practice mode separate from challenge privilege and runtime selection

Why

Production Dojo provides this file through its read-only DojoFS mount. The local Nix workspace does not. Legacy Green /usr/local/bin/vm helpers read it on every non-root invocation and otherwise fail with FileNotFoundError. Restoring this ambient workspace contract centrally avoids changing any challenge.

Verification

• targeted formatter check: clean
• workspace-agent packages build with go test ./...
• independent mainline workspace launch as uid 1000: value zero, mode 0444
• integration-stack real solves from kernel-security, speculative-execution, and system-exploitation: 3 challenges / 6 testcases

CI prerequisite

The formatter-only fix in #271 is merged into main.