workspace.export: add base_commit to capture worker git commits

Without base_commit, export diffs against the current guest HEAD.
If the worker ran git commit inside the VM, HEAD advanced and the
diff came back empty — committed work was silently lost.

With base_commit set to the head_commit from workspace.prepare,
the diff uses that fixed point instead. After git add -A the index
holds the full working state, so git diff --cached <base_commit>
captures everything: committed deltas (HEAD moved past base) and
any uncommitted changes on top, in one patch, applied with the
same git apply flow.

- WorkspaceExportParams gains base_commit
- WorkspaceExportResult echoes back the ref actually used
- CLI gains --base-commit flag
- Tests assert scripts use the caller-supplied ref and that
  omitting it falls back to HEAD

internal/api/types.go

@@ -215,12 +215,14 @@ type GuestSessionSendResult struct {
 }
 
 type WorkspaceExportParams struct {
-	IDOrName  string `json:"id_or_name"`
-	GuestPath string `json:"guest_path,omitempty"`
+	IDOrName   string `json:"id_or_name"`
+	GuestPath  string `json:"guest_path,omitempty"`
+	BaseCommit string `json:"base_commit,omitempty"`
 }
 
 type WorkspaceExportResult struct {
 	GuestPath    string   `json:"guest_path"`
+	BaseCommit   string   `json:"base_commit"`
 	Patch        []byte   `json:"patch"`
 	ChangedFiles []string `json:"changed_files"`
 	HasChanges   bool     `json:"has_changes"`