feat(workspace): sealed-area names are confidential by default

The switcher listed sealed areas by name ('lbs', 'stromnetz') on
any glance or screenshot — but the names themselves often carry
client/mandate identity (usertest security finding). The sealed
section now renders one aggregated row ('2 sealed areas') with a
deliberate 'Show names' reveal per menu opening; selection still
pops the regular s:<slug> value. Settings -> Security gains 'list
sealed areas with their names right away' (WorkspacePrefs,
SidebarPrefs pattern, default off).

The aggregate row wraps to two lines — popup menus cap their
width and action texts must never be truncated (the first cut
showed '1 abgeschotte…' in the proof shot). Guard: switcher tests
cover aggregated-until-reveal and the Settings toggle; the old
direct-listing test now asserts the reveal contract. DE+EN.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

CHANGELOG.md

@@ -6,6 +6,16 @@ lockstep.
 
 ## Unreleased
 
+### Security (0.75.0)
+
+- **Sealed-area names are confidential by default.** The workspace
+  switcher no longer lists sealed areas by name on a casual glance
+  (names often carry client/mandate identity — usertest security
+  finding): it shows one aggregated row ("2 sealed areas") and
+  reveals the named rows only after a deliberate click, per menu
+  opening. Settings → Security offers "list sealed areas with
+  their names right away" for single-operator machines.
+
 ### Changed (0.75.0)
 
 - **One segment control everywhere.** The same single-select