workspace.export: add base_commit to capture worker git commits

Without base_commit, export diffs against the current guest HEAD.
If the worker ran git commit inside the VM, HEAD advanced and the
diff came back empty — committed work was silently lost.

With base_commit set to the head_commit from workspace.prepare,
the diff uses that fixed point instead. After git add -A the index
holds the full working state, so git diff --cached <base_commit>
captures everything: committed deltas (HEAD moved past base) and
any uncommitted changes on top, in one patch, applied with the
same git apply flow.

- WorkspaceExportParams gains base_commit
- WorkspaceExportResult echoes back the ref actually used
- CLI gains --base-commit flag
- Tests assert scripts use the caller-supplied ref and that
  omitting it falls back to HEAD

internal/cli/cli_test.go

@@ -2218,3 +2218,30 @@ func TestVMWorkspaceExportGuestPathFlag(t *testing.T) {
 		t.Fatalf("IDOrName = %q, want devbox", capturedParams.IDOrName)
 	}
 }
+
+func TestVMWorkspaceExportBaseCommitFlag(t *testing.T) {
+	stubEnsureDaemonForSend(t)
+
+	origExport := vmWorkspaceExportFunc
+	t.Cleanup(func() { vmWorkspaceExportFunc = origExport })
+
+	var capturedParams api.WorkspaceExportParams
+	vmWorkspaceExportFunc = func(_ context.Context, _ string, params api.WorkspaceExportParams) (api.WorkspaceExportResult, error) {
+		capturedParams = params
+		return api.WorkspaceExportResult{
+			HasChanges: false,
+			BaseCommit: params.BaseCommit,
+		}, nil
+	}
+
+	cmd := NewBangerCommand()
+	cmd.SetOut(io.Discard)
+	cmd.SetErr(io.Discard)
+	cmd.SetArgs([]string{"vm", "workspace", "export", "devbox", "--base-commit", "abc1234deadbeef"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("Execute: %v", err)
+	}
+	if capturedParams.BaseCommit != "abc1234deadbeef" {
+		t.Fatalf("BaseCommit = %q, want abc1234deadbeef", capturedParams.BaseCommit)
+	}
+}