feat(workspace): one global switcher anchor in the shell sidebar

The switcher used to be embedded per page (Flows/Runs/Audit/
Approvals) — invisible on the other five pages and sitting in a
different corner depending on the page (persona review 2026-08-27,
consensus finding). It now lives ONCE in the sidebar, above the
destinations: active project/area always visible, opens the same
menu everywhere, Cmd+P from anywhere. The shell listens to the
workspace, so the sidebar endpoint label can no longer lag a
sealed switch until the next health tick.

Also in this rebuild:

* Stopped sealed areas ask before starting ("Start area X?") —
  a context switch must never boot a hub daemon as a click
  side-effect; running areas keep switching with one click.
* The switcher tooltip told a wrong scope ("filters this view") —
  it now says the choice applies everywhere and stamps new runs.
* The aggregated sealed row explains itself in place (names can
  reveal client identities) and links to the Settings toggle
  (Settings dialog gained an initialCategory jump).
* The active entry carries a checkmark in the menu.
* The Cmd+K palette knows projects and areas, ranked by recent
  use; sealed names honour the privacy setting — while hidden,
  the palette offers the guarded picker instead of the names.
* The runs empty state names the active project filter as the
  cause ("No runs in project X" + show-all action) instead of
  claiming the feature is off.

Tests updated to the anchor and made hermetic (scriptable
projects on the fake hub, sealed-area fake); new coverage for the
checkmark, the why-line, and the start confirmation.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_en.arb

@@ -1437,6 +1437,9 @@
   "searchHintOpen": "enter open",
   "searchHintClose": "esc close",
   "searchGroupPages": "Pages",
+  "searchGroupWorkspace": "Projects & areas",
+  "searchWorkspaceHint": "switch context · ⌘P",
+  "searchWorkspaceSealedPickerHint": "open the picker · ⌘P",
   "searchGroupModules": "Modules",
   "searchGroupStore": "Store",
   "searchGroupFlows": "Flows",
@@ -1872,7 +1875,14 @@
   "federationEnrollmentHint": "Hand the token to the satellite operator over a secure channel. The bundled CA authenticates the satellite's first connect.",
   "workspaceAll": "All projects",
   "workspaceDefaultProject": "General",
-  "workspaceSwitcherTooltip": "Workspace — filters this view and stamps new runs with the selected project",
+  "workspaceSwitcherTooltip": "Choose the working context — applies everywhere: filters flows, runs, audit and approvals, and stamps new runs with the selected project",
+  "workspaceAnchorCaption": "Project / area",
+  "workspaceStartConfirmTitle": "Start area “{name}”?",
+  "@workspaceStartConfirmTitle": {"placeholders": {"name": {"type": "String"}}},
+  "workspaceStartConfirmBody": "This sealed area is currently stopped. Studio starts its own hub instance on this machine and connects to it — running areas switch without this prompt.",
+  "workspaceStartConfirmAction": "Start and connect",
+  "workspaceSealedAggregateWhy": "Names stay aggregated because they can reveal client identities.",
+  "workspaceSealedAggregateSettings": "Always show: Settings → Security",
   "workspaceProtectedHint": "Protected: logically separated in the shared hub — no hard process barrier. Critical engagements use a sealed area.",
   "runsTitle": "Runs",
   "runsReloadTooltip": "Reload the runs list",
@@ -1880,6 +1890,10 @@
   "runsEmptyHint": "Runs that keep working in the background while you do something else appear here. The feature is optional and off by default — the guide shows step by step how to turn it on.",
   "runsEmptyEnabledHint": "Background runs are switched on — none has been started yet. Start a flow with the \"run in background\" option and it will appear here.",
   "runsEmptyGuideButton": "Open the guide",
+  "runsEmptyFilteredTitle": "No runs in project “{name}”",
+  "@runsEmptyFilteredTitle": {"placeholders": {"name": {"type": "String"}}},
+  "runsEmptyFilteredHint": "The working context filters this list — other projects may have runs.",
+  "runsEmptyShowAll": "Show all projects",
   "runsHubTooOldTitle": "This view needs a newer hub version",
   "runsHubTooOldHint": "The hub is connected, but its version does not know the runs monitor yet. Update the hub and the runs will appear here.",
   "runsHubTooOldButton": "Open Doctor",