Add persistent workspace shell sessions

Let agents inhabit a workspace across separate calls instead of only submitting one-shot execs.

Add workspace shell open/read/write/signal/close across the CLI, Python SDK, and MCP server, with persisted shell records, a local PTY-backed mock implementation, and guest-agent support for real Firecracker workspaces.

Mark the 2.5.0 roadmap milestone done, refresh docs/examples and the release metadata, and verify with uv lock, UV_CACHE_DIR=.uv-cache make check, and UV_CACHE_DIR=.uv-cache make dist-check.

docs/roadmap/task-workspace-ga.md

@@ -2,11 +2,12 @@
 
 This roadmap turns the agent-workspace vision into release-sized milestones.
 
-Current baseline is `2.4.0`:
+Current baseline is `2.5.0`:
 
 - workspace persistence exists and the public surface is now workspace-first
 - host crossing currently covers create-time seeding and later sync push
-- no shell, export, diff, service, snapshot, reset, or secrets contract exists yet
+- persistent PTY shell sessions exist alongside one-shot `workspace exec`
+- no export, diff, service, snapshot, reset, or secrets contract exists yet
 
 Locked roadmap decisions:
 
@@ -26,7 +27,7 @@ also expected to update:
 ## Milestones
 
 1. [`2.4.0` Workspace Contract Pivot](task-workspace-ga/2.4.0-workspace-contract-pivot.md) - Done
-2. [`2.5.0` PTY Shell Sessions](task-workspace-ga/2.5.0-pty-shell-sessions.md)
+2. [`2.5.0` PTY Shell Sessions](task-workspace-ga/2.5.0-pty-shell-sessions.md) - Done
 3. [`2.6.0` Structured Export And Baseline Diff](task-workspace-ga/2.6.0-structured-export-and-baseline-diff.md)
 4. [`2.7.0` Service Lifecycle And Typed Readiness](task-workspace-ga/2.7.0-service-lifecycle-and-typed-readiness.md)
 5. [`2.8.0` Named Snapshots And Reset](task-workspace-ga/2.8.0-named-snapshots-and-reset.md)

docs/roadmap/task-workspace-ga/2.5.0-pty-shell-sessions.md

@@ -1,5 +1,7 @@
 # `2.5.0` PTY Shell Sessions
 
+Status: Done
+
 ## Goal
 
 Add persistent interactive shells so an agent can inhabit a workspace instead