Prevent stale workflow workspaces

[eshulman2]

Summary

• use ownership-aware cleanup for recovery backups and normal workspace teardown
• preserve the current registry entry when deleting a superseded workspace
• clean workspaces recreated during CI/review when a workflow reaches complete
• bound Podman cleanup attempts and fall back to shutil

Production cleanup

Removed the stale AISOS-2385 and AISOS-2386 directories from forge-worker-1; /tmp usage dropped from 1.7 GB to 2.7 MB.

Validation

• 23 passed, 65 deselected (focused workspace and terminal-cleanup tests)
• Ruff passed for all changed files
• git diff --check passed