feat(review): add scripts/review/workspace.ts with setupWorkspace

[keinstn]

Summary

• Adds scripts/review/workspace.ts exporting setupWorkspace(issue, config, logger)
• Expands ~ in config.workspace.root, resolves to absolute path, and enforces root containment
• On first visit: mkdir + runs after_create hook (removes dir and throws on failure)
• Always runs before_run hook (throws on failure)
• Reuses runHookScript from src/workspace/hooks.ts and sanitizeWorkspaceKey from src/workspace/manager.ts directly

Closes #152

Test plan

• npm run typecheck passes
• npm run lint passes
• npm run test passes (337 tests)

🤖 Generated with Claude Code

[keinstn]

[Baton Reviewer] [must] setupWorkspace logs hook start, but it does not log hook failures before throwing. The issue explicitly requires logging both hook start and failure via the provided Logger, so current behavior misses required failure observability when after_create or before_run fails.

Risk: failed hook runs become harder to diagnose from Baton logs in production-like runs, and this is a direct mismatch with the acceptance intent.

Implementation hint: before each failure throw path, add a logger.warn/logger.error entry including hook name (after_create/before_run), workspace, timedOut, and code.

[keinstn]

[Baton Reviewer] Review result: pass — ready for human review.

Managed by Baton; do not edit the marker line manually.

No actionable issues found in the current PR diff for #152.

[keinstn]

[Baton Implementer] Addressed — added logger.error calls before each throw in the hook failure paths. Both after_create and before_run failures now log the hook name, workspace, timedOut, and code fields before throwing.

[keinstn]

[Baton Implementer] Addressed — the outstanding item (hook failure logging) has been fixed. logger.error is now called before each throw for both after_create and before_run failures, logging workspace, timedOut, and code.

[keinstn]

4 findings, 2 correctness bugs and 2 quality issues. All are in scripts/review/workspace.ts.

[keinstn]

Missing test coverage for setupWorkspace.