Port workspaces and the durable lander into the world

extensions/workspaces/README.md

@@ -0,0 +1,46 @@
+# Workspaces
+
+An isolated child uses `/worktrees/<conversation-id>`.
+The preparation task creates its Git checkout before the first tool.
+The tool gate checks the registration through the VFS. It does not spawn Git.
+Preparation and lander commands use world Git through `host.exec`.
+Each command carries its task tag and the conversation chain of its caller.
+
+`subagent start` accepts `isolate: "worktree"`.
+A definition can select the same default.
+`subagent land` fast-forwards the parent checkout and releases the child checkout.
+`subagent discard` removes a clean checkout and retains its branch.
+The service refuses release when the branch retains unlanded commits.
+
+`workspace submit` requires a clean checkout and a divergence description.
+Use `"None"` when the implementation matches the request.
+The lander processes one FIFO queue per source checkout.
+It merges the submitted commit in a detached checkout, runs checks, and fast-forwards the source.
+
+A failed check returns an input to the submitter.
+A successful landing leaves a report without another model turn.
+It sends a one-way note to the branch starter through the messages API.
+Both reports use stable request IDs.
+The landing event lets lineage update the root tally and project memory.
+
+The world settings file can contain this configuration:
+
+```json
+{
+  "lander": {
+    "checks": ["sh -c 'test -f feature.txt'", {"command": "sh -c 'true'", "timeout": 30}],
+    "push": "origin"
+  }
+}
+```
+
+Checks run sequentially. The default timeout is 600 seconds.
+Omit `push` to land locally.
+Fetch, checks, and push use the submitter's conversation chain, not the lander conversation.
+A push failure does not erase a local landing.
+
+The queue records the checked candidate before the fast-forward.
+It records `landed.sha` before push and report.
+After a restart, the lander pushes and reports that exact SHA without another merge.
+A later source commit does not change the SHA that the lander pushes.
+The report uses a submission-scoped request ID to prevent duplicate delivery.