feat(vm): add vm exec command with workspace dirty detection

Introduces three interconnected features for persistent VM workflows:

1. `banger vm exec <vm> -- <cmd>`: runs a command in the prepared
   workspace, automatically cd-ing into the guest path and wrapping
   via `mise exec --` so mise-managed tools are on PATH. Falls back
   to a plain exec when mise isn't available. Exit code propagates
   verbatim.

2. Workspace persistence: workspace.prepare now stores the guest path,
   host source path, and HEAD commit into a new `workspace_json` column
   on the vms table (migration 3). This state survives daemon restarts
   and informs both dirty-checking and auto-prepare.

3. Dirty detection: `vm exec` compares the stored HEAD commit against
   the current host repo HEAD. When stale it warns and, with
   --auto-prepare, re-syncs the workspace before running.

Also:
- WORKSPACE column added to `banger ps` / `vm list`
- `banger vm` quick reference updated with `vm exec` entry

internal/cli/printers.go

@@ -98,13 +98,13 @@ func printVMIDList(out anyWriter, vms []model.VMRecord) error {
 
 func printVMListTable(out anyWriter, vms []model.VMRecord, imageNames map[string]string) error {
 	w := tabwriter.NewWriter(out, 0, 8, 2, ' ', 0)
-	if _, err := fmt.Fprintln(w, "ID\tNAME\tSTATE\tIMAGE\tIP\tVCPU\tMEM\tDISK\tCREATED"); err != nil {
+	if _, err := fmt.Fprintln(w, "ID\tNAME\tSTATE\tIMAGE\tIP\tVCPU\tMEM\tDISK\tWORKSPACE\tCREATED"); err != nil {
 		return err
 	}
 	for _, vm := range vms {
 		if _, err := fmt.Fprintf(
 			w,
-			"%s\t%s\t%s\t%s\t%s\t%d\t%d MiB\t%s\t%s\n",
+			"%s\t%s\t%s\t%s\t%s\t%d\t%d MiB\t%s\t%s\t%s\n",
 			shortID(vm.ID),
 			vm.Name,
 			vm.State,
@@ -113,6 +113,7 @@ func printVMListTable(out anyWriter, vms []model.VMRecord, imageNames map[string
 			vm.Spec.VCPUCount,
 			vm.Spec.MemoryMiB,
 			model.FormatSizeBytes(vm.Spec.WorkDiskSizeBytes),
+			dashIfEmpty(vm.Workspace.GuestPath),
 			relativeTime(vm.CreatedAt),
 		); err != nil {
 			return err