fix([issue-4293]): name rejected workspace paths

[atomantic]

Summary:

• Add a shared redacted server-only diagnostic naming rejected workspace paths and checked roots.
• Log all four workspace-root confinement rejection sites without changing response bodies or status codes.
• Add helper tests, catalog documentation, and the issue changelog fragment.

Closes #4293

Test plan:

• npm test --prefix server -- lib/workspaceRoots.test.js routes/git.test.js routes/scaffold.test.js — 60 passed, 3 skipped.
• npm test --prefix server — 1,407 passed, 27 skipped; 2 unrelated environment-sensitive routes/health.test.js assertions failed.
• git diff --check

Review status:

• Codex review findings were applied through multiple review-and-fix passes.
• The final Codex pass remained active beyond the bounded wait and was terminated; final review status is inconclusive.