Add workspace export and baseline diff

Complete the 2.6.0 workspace milestone by adding explicit host-out export and immutable-baseline diff across the CLI, Python SDK, and MCP server.

Capture a baseline archive at workspace creation, export live /workspace paths through the guest agent, and compute structured whole-workspace diffs on the host without affecting command logs or shell state. The docs, roadmap, bundled guest agent, and workspace example now reflect the new create -> sync -> diff -> export workflow.

Validation: uv lock, UV_CACHE_DIR=.uv-cache make check, UV_CACHE_DIR=.uv-cache make dist-check, and a real guest-backed Firecracker smoke covering workspace create, sync push, diff, export, and delete.

src/pyro_mcp/contract.py

@@ -8,7 +8,9 @@ PUBLIC_CLI_ENV_SUBCOMMANDS = ("inspect", "list", "pull", "prune")
 PUBLIC_CLI_WORKSPACE_SUBCOMMANDS = (
     "create",
     "delete",
+    "diff",
     "exec",
+    "export",
     "logs",
     "shell",
     "status",
@@ -25,6 +27,8 @@ PUBLIC_CLI_WORKSPACE_CREATE_FLAGS = (
     "--seed-path",
     "--json",
 )
+PUBLIC_CLI_WORKSPACE_DIFF_FLAGS = ("--json",)
+PUBLIC_CLI_WORKSPACE_EXPORT_FLAGS = ("--output", "--json")
 PUBLIC_CLI_WORKSPACE_SHELL_OPEN_FLAGS = ("--cwd", "--cols", "--rows", "--json")
 PUBLIC_CLI_WORKSPACE_SHELL_READ_FLAGS = ("--cursor", "--max-chars", "--json")
 PUBLIC_CLI_WORKSPACE_SHELL_WRITE_FLAGS = ("--input", "--no-newline", "--json")
@@ -48,8 +52,10 @@ PUBLIC_SDK_METHODS = (
     "create_workspace",
     "delete_vm",
     "delete_workspace",
+    "diff_workspace",
     "exec_vm",
     "exec_workspace",
+    "export_workspace",
     "inspect_environment",
     "list_environments",
     "logs_workspace",
@@ -87,7 +93,9 @@ PUBLIC_MCP_TOOLS = (
     "vm_stop",
     "workspace_create",
     "workspace_delete",
+    "workspace_diff",
     "workspace_exec",
+    "workspace_export",
     "workspace_logs",
     "workspace_status",
     "workspace_sync_push",