fix(workspace): close the sealed-switch privacy race, restore the parked filter

Two findings from the workspace persona review, both rated high:

* Switch race: the hub client re-pointed at a sealed area's hub
  before the workspace announced the sealed context, so the 2 s
  page pollers (runs, audit) could fetch and render that hub's
  data without the sealed marking. Switches now run inside an
  explicit switching window: opened before anything touches the
  connection, announced optimistically in the identity bar
  ("switching…" + spinner, leave button hidden), pollers and the
  shell health tick pause inside it, and pages drop replies whose
  context epoch changed mid-flight. The sealed context is
  announced only after the new hub answered healthy.

* Filter loss: entering a sealed area cleared the shared-hub
  project filter and returning restored only the endpoint. The
  filter is now parked on entry and restored on return; prefs
  keep the parked value throughout, so live state and prefs agree
  after the round trip (and after a mid-session relaunch).

Guard: workspace_switch_race_test pins both invariants
state-matrix-style against scripted hub + sealed-area fakes —
reconnects may only happen inside an open switch window, pollers
must stay silent inside it, and the filter must survive the round
trip. SealedAreaService gained a debugSetInstance seam so the
suite never scans a real ~/.chain.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_de.arb

@@ -1877,6 +1877,7 @@
   "workspaceSealedSwitchFailed": "Wechsel in den abgeschotteten Bereich fehlgeschlagen: {error}",
   "@workspaceSealedSwitchFailed": {"placeholders": {"error": {"type": "String"}}},
   "sealedIdentityBar": "Abgeschotteter Bereich — isolierter Hub, eigene Daten und Audit-Kette",
+  "sealedSwitchingBar": "Verbindung wird umgeschaltet — Daten erscheinen erst nach Abschluss",
   "sealedLeave": "Verlassen",
   "setupStepOf": "Schritt {n} von {total}",
   "@setupStepOf": {"placeholders": {"n": {"type": "int"}, "total": {"type": "int"}}},

lib/l10n/app_en.arb

@@ -1916,6 +1916,7 @@
   "workspaceSealedSwitchFailed": "Could not switch to the sealed area: {error}",
   "@workspaceSealedSwitchFailed": {"placeholders": {"error": {"type": "String"}}},
   "sealedIdentityBar": "Sealed area — isolated hub, own data and audit chain",
+  "sealedSwitchingBar": "Switching connection — data appears once the switch completes",
   "sealedLeave": "Leave",
   "setupStepOf": "Step {n} of {total}",
   "@setupStepOf": {"placeholders": {"n": {"type": "int"}, "total": {"type": "int"}}},

lib/l10n/app_localizations.dart

@@ -5977,6 +5977,12 @@ abstract class AppLocalizations {
   /// **'Sealed area — isolated hub, own data and audit chain'**
   String get sealedIdentityBar;
 
+  /// No description provided for @sealedSwitchingBar.
+  ///
+  /// In en, this message translates to:
+  /// **'Switching connection — data appears once the switch completes'**
+  String get sealedSwitchingBar;
+
   /// No description provided for @sealedLeave.
   ///
   /// In en, this message translates to:

lib/l10n/app_localizations_de.dart

@@ -3556,6 +3556,10 @@ class AppLocalizationsDe extends AppLocalizations {
   String get sealedIdentityBar =>
       'Abgeschotteter Bereich — isolierter Hub, eigene Daten und Audit-Kette';
 
+  @override
+  String get sealedSwitchingBar =>
+      'Verbindung wird umgeschaltet — Daten erscheinen erst nach Abschluss';
+
   @override
   String get sealedLeave => 'Verlassen';
 

lib/l10n/app_localizations_en.dart

@@ -3548,6 +3548,10 @@ class AppLocalizationsEn extends AppLocalizations {
   String get sealedIdentityBar =>
       'Sealed area — isolated hub, own data and audit chain';
 
+  @override
+  String get sealedSwitchingBar =>
+      'Switching connection — data appears once the switch completes';
+
   @override
   String get sealedLeave => 'Leave';