Add workspace naming and discovery

Make concurrent workspaces easier to rediscover and resume without relying on opaque IDs alone.

Add optional workspace names, key/value labels, workspace list, and workspace update across the CLI, Python SDK, and MCP surface, and persist last_activity_at so list ordering reflects real mutating activity.

Update the stable contract, install/first-run docs, roadmap, and Python workspace example to teach the new discovery flow, and validate it with focused manager/CLI/API/server coverage plus uv lock, make check, make dist-check, and a real multi-workspace smoke for create, list, update, exec, reorder, and delete.

examples/python_workspace.py

@@ -22,6 +22,8 @@ def main() -> None:
         created = pyro.create_workspace(
             environment="debian:12",
             seed_path=seed_dir,
+            name="repro-fix",
+            labels={"issue": "123"},
             network_policy="egress+published-ports",
             secrets=[
                 {"name": "API_TOKEN", "value": "expected"},
@@ -30,6 +32,13 @@ def main() -> None:
         )
         workspace_id = str(created["workspace_id"])
         try:
+            listed = pyro.list_workspaces()
+            print(f"workspace_count={listed['count']}")
+            updated = pyro.update_workspace(
+                workspace_id,
+                labels={"owner": "codex"},
+            )
+            print(updated["labels"]["owner"])
             pyro.push_workspace_sync(workspace_id, sync_dir)
             files = pyro.list_workspace_files(workspace_id, path="/workspace", recursive=True)
             print(f"workspace_entries={len(files['entries'])}")