fix(workspace): close the sealed-switch privacy race, restore the parked filter

Two findings from the workspace persona review, both rated high:

* Switch race: the hub client re-pointed at a sealed area's hub
  before the workspace announced the sealed context, so the 2 s
  page pollers (runs, audit) could fetch and render that hub's
  data without the sealed marking. Switches now run inside an
  explicit switching window: opened before anything touches the
  connection, announced optimistically in the identity bar
  ("switching…" + spinner, leave button hidden), pollers and the
  shell health tick pause inside it, and pages drop replies whose
  context epoch changed mid-flight. The sealed context is
  announced only after the new hub answered healthy.

* Filter loss: entering a sealed area cleared the shared-hub
  project filter and returning restored only the endpoint. The
  filter is now parked on entry and restored on return; prefs
  keep the parked value throughout, so live state and prefs agree
  after the round trip (and after a mid-session relaunch).

Guard: workspace_switch_race_test pins both invariants
state-matrix-style against scripted hub + sealed-area fakes —
reconnects may only happen inside an open switch window, pollers
must stay silent inside it, and the filter must survive the round
trip. SealedAreaService gained a debugSetInstance seam so the
suite never scans a real ~/.chain.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/main.dart

@@ -553,6 +553,10 @@ class StudioShellState extends State<StudioShell> {
   }
 
   Future<void> _checkHealth({bool retriedAfterTokenReload = false}) async {
+    // Skip the tick while a sealed-area switch is in flight — the
+    // client points between contexts and a probe result (or the
+    // approvals badge) would be attributed to the wrong hub.
+    if (Workspace.instance.switching) return;
     final probe = debugProbeOverride != null
         ? await debugProbeOverride!()
         : await HubService.instance.probeHealth();