feat: sealed-area connection switch + identity bar (multi-project stage 3)

The workspace switcher now lists the operator's sealed areas (read from
~/.chain/sealed/ manifests, the same source the CLI uses) below the
shared projects, each with a lock icon and a running/stopped status.
Selecting one is a real connection switch: Studio reconnects its hub
client to the area's own port with a full state reload — one window,
one truth. A stopped area is started first (chain project start) with a
visible notice; a failure surfaces as a copyable error and rolls back to
the shared hub.

While in a sealed area an identity bar under the AppBar is painted in
the area's accent colour and names it, with a one-click Leave back to
the shared hub. The area colour is marking, not theming — Studio's blue
stays the app accent. Selecting a shared project from inside an area
switches the connection back first. The sealed connection is never
persisted across restarts.

New: SealedAreaService (manifest + PID discovery), Workspace sealed
switch logic, ChainSealedIdentityBar, SystemActions.chainProjectStart.
l10n DE+EN. flutter analyze clean; 33 tests green (switcher lists sealed
with lock+status, pill shows active area, identity bar renders in the
area colour). Runtime plumbing (discovery, start, endpoint, reach)
verified headlessly against real sealed instances under a redirected
HOME; the identity-bar screenshot is deferred (display click-automation
failed after sleep on the shared desktop — an environment issue, not a
code gap; the visible components are widget-tested).

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_de.arb

@@ -1684,5 +1684,16 @@
   "runsPhaseFailed": "Fehlgeschlagen",
   "runsPhaseCancelled": "Abgebrochen",
   "runsPhaseUnknown": "Unbekannt",
-  "navRuns": "Läufe"
+  "navRuns": "Läufe",
+  "workspaceSealedHeader": "ABGESCHOTTETE BEREICHE",
+  "workspaceSealedRunning": "läuft",
+  "workspaceSealedStopped": "gestoppt",
+  "workspaceSealedStarting": "Starte abgeschotteten Bereich „{name}“…",
+  "@workspaceSealedStarting": {"placeholders": {"name": {"type": "String"}}},
+  "workspaceSealedStarted": "Abgeschotteter Bereich „{name}“ gestartet.",
+  "@workspaceSealedStarted": {"placeholders": {"name": {"type": "String"}}},
+  "workspaceSealedSwitchFailed": "Wechsel in den abgeschotteten Bereich fehlgeschlagen: {error}",
+  "@workspaceSealedSwitchFailed": {"placeholders": {"error": {"type": "String"}}},
+  "sealedIdentityBar": "Abgeschotteter Bereich — isolierter Hub, eigene Daten und Audit-Kette",
+  "sealedLeave": "Verlassen"
 }

lib/l10n/app_en.arb

@@ -1723,5 +1723,16 @@
   "runsPhaseFailed": "Failed",
   "runsPhaseCancelled": "Cancelled",
   "runsPhaseUnknown": "Unknown",
-  "navRuns": "Runs"
+  "navRuns": "Runs",
+  "workspaceSealedHeader": "SEALED AREAS",
+  "workspaceSealedRunning": "running",
+  "workspaceSealedStopped": "stopped",
+  "workspaceSealedStarting": "Starting sealed area “{name}”…",
+  "@workspaceSealedStarting": {"placeholders": {"name": {"type": "String"}}},
+  "workspaceSealedStarted": "Started sealed area “{name}”.",
+  "@workspaceSealedStarted": {"placeholders": {"name": {"type": "String"}}},
+  "workspaceSealedSwitchFailed": "Could not switch to the sealed area: {error}",
+  "@workspaceSealedSwitchFailed": {"placeholders": {"error": {"type": "String"}}},
+  "sealedIdentityBar": "Sealed area — isolated hub, own data and audit chain",
+  "sealedLeave": "Leave"
 }

lib/l10n/app_localizations.dart

@@ -4998,6 +4998,54 @@ abstract class AppLocalizations {
   /// In en, this message translates to:
   /// **'Runs'**
   String get navRuns;
+
+  /// No description provided for @workspaceSealedHeader.
+  ///
+  /// In en, this message translates to:
+  /// **'SEALED AREAS'**
+  String get workspaceSealedHeader;
+
+  /// No description provided for @workspaceSealedRunning.
+  ///
+  /// In en, this message translates to:
+  /// **'running'**
+  String get workspaceSealedRunning;
+
+  /// No description provided for @workspaceSealedStopped.
+  ///
+  /// In en, this message translates to:
+  /// **'stopped'**
+  String get workspaceSealedStopped;
+
+  /// No description provided for @workspaceSealedStarting.
+  ///
+  /// In en, this message translates to:
+  /// **'Starting sealed area “{name}”…'**
+  String workspaceSealedStarting(String name);
+
+  /// No description provided for @workspaceSealedStarted.
+  ///
+  /// In en, this message translates to:
+  /// **'Started sealed area “{name}”.'**
+  String workspaceSealedStarted(String name);
+
+  /// No description provided for @workspaceSealedSwitchFailed.
+  ///
+  /// In en, this message translates to:
+  /// **'Could not switch to the sealed area: {error}'**
+  String workspaceSealedSwitchFailed(String error);
+
+  /// No description provided for @sealedIdentityBar.
+  ///
+  /// In en, this message translates to:
+  /// **'Sealed area — isolated hub, own data and audit chain'**
+  String get sealedIdentityBar;
+
+  /// No description provided for @sealedLeave.
+  ///
+  /// In en, this message translates to:
+  /// **'Leave'**
+  String get sealedLeave;
 }
 
 class _AppLocalizationsDelegate

lib/l10n/app_localizations_de.dart

@@ -2933,4 +2933,35 @@ class AppLocalizationsDe extends AppLocalizations {
 
   @override
   String get navRuns => 'Läufe';
+
+  @override
+  String get workspaceSealedHeader => 'ABGESCHOTTETE BEREICHE';
+
+  @override
+  String get workspaceSealedRunning => 'läuft';
+
+  @override
+  String get workspaceSealedStopped => 'gestoppt';
+
+  @override
+  String workspaceSealedStarting(String name) {
+    return 'Starte abgeschotteten Bereich „$name“…';
+  }
+
+  @override
+  String workspaceSealedStarted(String name) {
+    return 'Abgeschotteter Bereich „$name“ gestartet.';
+  }
+
+  @override
+  String workspaceSealedSwitchFailed(String error) {
+    return 'Wechsel in den abgeschotteten Bereich fehlgeschlagen: $error';
+  }
+
+  @override
+  String get sealedIdentityBar =>
+      'Abgeschotteter Bereich — isolierter Hub, eigene Daten und Audit-Kette';
+
+  @override
+  String get sealedLeave => 'Verlassen';
 }

lib/l10n/app_localizations_en.dart

@@ -2936,4 +2936,35 @@ class AppLocalizationsEn extends AppLocalizations {
 
   @override
   String get navRuns => 'Runs';
+
+  @override
+  String get workspaceSealedHeader => 'SEALED AREAS';
+
+  @override
+  String get workspaceSealedRunning => 'running';
+
+  @override
+  String get workspaceSealedStopped => 'stopped';
+
+  @override
+  String workspaceSealedStarting(String name) {
+    return 'Starting sealed area “$name”…';
+  }
+
+  @override
+  String workspaceSealedStarted(String name) {
+    return 'Started sealed area “$name”.';
+  }
+
+  @override
+  String workspaceSealedSwitchFailed(String error) {
+    return 'Could not switch to the sealed area: $error';
+  }
+
+  @override
+  String get sealedIdentityBar =>
+      'Sealed area — isolated hub, own data and audit chain';
+
+  @override
+  String get sealedLeave => 'Leave';
 }