Agent workspaces: per-contract overlays with instant handoff

- WorkspaceManager: create/get/list workspaces with daily/weekly/monthly/pinned tiers
- Saved searches: agent stores SQL queries in workspace context
- Shortlist: tag candidates/records to a workspace with notes
- Activity log: track calls, emails, updates per workspace per agent
- Instant handoff: transfer workspace ownership with full history
  Zero data copy — just a pointer swap, receiving agent sees everything
- Persistence: workspaces stored as JSON in object storage, rebuilt on startup
- Endpoints: /workspaces/create, /{id}, /{id}/handoff, /{id}/search,
  /{id}/shortlist, /{id}/activity
- Tested: Sarah creates workspace, saves searches, shortlists 3 candidates,
  logs activity, hands off to Mike who continues seamlessly

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/gateway/src/main.rs

@@ -30,10 +30,16 @@ async fn main() {
         tracing::warn!("catalog rebuild failed (empty store?): {e}");
     }
 
-    // Query engine with 16GB memory cache (configurable)
-    let cache = queryd::cache::MemCache::new(16 * 1024 * 1024 * 1024); // 16GB
+    // Query engine with 16GB memory cache
+    let cache = queryd::cache::MemCache::new(16 * 1024 * 1024 * 1024);
     let engine = queryd::context::QueryEngine::new(registry.clone(), store.clone(), cache);
 
+    // Workspace manager for agent-specific overlays
+    let workspace_mgr = queryd::workspace::WorkspaceManager::new(store.clone());
+    if let Err(e) = workspace_mgr.rebuild().await {
+        tracing::warn!("workspace rebuild: {e}");
+    }
+
     // AI sidecar client
     let ai_client = aibridge::client::AiClient::new(&config.sidecar.url);
 
@@ -51,7 +57,8 @@ async fn main() {
         .nest("/vectors", vectord::service::router(vectord::service::VectorState {
             store: store.clone(),
             ai_client: ai_client.clone(),
-        }));
+        }))
+        .nest("/workspaces", queryd::workspace_service::router(workspace_mgr));
 
     // Auth middleware (if enabled)
     if config.auth.enabled {