Implement workspace manifests for expected repository sets

[codeforester]

Finding

docs/workspace-manifest.md defines the right model for a team-shared workspace contract, but current workspace commands still operate only on discovered local repositories. They cannot yet answer the v1 team-onboarding questions:

• Which repositories are expected in this workspace?
• Which required repositories are missing?
• Which optional repositories are absent but acceptable?
• Which local Base-managed projects are outside the expected set?

This is one of the clearest ways Base can fill a real gap between Homebrew, mise, direnv, Docker/Dev Containers, and generic task runners: Base can make the multi-repo local workspace inspectable without becoming a repo-sync tool or secrets manager.

Project fields

• Priority: P1
• Size: L
• Initiative: Workspace Onboarding

Expected outcome

Add first runtime support for a local workspace manifest, keeping the initial scope read-only.

A first implementation should support:

basectl workspace status --manifest <path>
basectl workspace check --manifest <path>
basectl workspace doctor --manifest <path>

It should report required/optional expected repos, missing repos, discovered repos outside the manifest, manifest validity, project venv status, and project diagnostics where local projects exist.

Suggested implementation

• Implement the schema documented in docs/workspace-manifest.md with schema_version, workspace.name, and repos.
• Keep the manifest local-path only for v1; do not fetch remote manifests yet.
• Treat missing required repos as errors and missing optional repos as warnings.
• Do not clone, pull, reset, or mutate repositories in this issue.
• Add stable JSON output for workspace status/check/doctor with explicit states.
• Preserve existing discovered-only behavior when no workspace manifest is supplied.

Validation

• Add Python tests for workspace manifest parsing and validation.
• Add workspace command tests for missing required, missing optional, outside-manifest local repo, invalid project manifest, and healthy workspace cases.
• Add JSON output tests for the same states.
• Run env -u BASE_HOME ./bin/base-test.