Add workspace export and baseline diff

Complete the 2.6.0 workspace milestone by adding explicit host-out export and immutable-baseline diff across the CLI, Python SDK, and MCP server.

Capture a baseline archive at workspace creation, export live /workspace paths through the guest agent, and compute structured whole-workspace diffs on the host without affecting command logs or shell state. The docs, roadmap, bundled guest agent, and workspace example now reflect the new create -> sync -> diff -> export workflow.

Validation: uv lock, UV_CACHE_DIR=.uv-cache make check, UV_CACHE_DIR=.uv-cache make dist-check, and a real guest-backed Firecracker smoke covering workspace create, sync push, diff, export, and delete.

tests/test_vm_guest.py

@@ -105,6 +105,54 @@ def test_vsock_exec_client_upload_archive_round_trip(
     assert stub.closed is True
 
 
+def test_vsock_exec_client_export_archive_round_trip(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    monkeypatch.setattr(socket, "AF_VSOCK", 40, raising=False)
+    archive_bytes = io.BytesIO()
+    with tarfile.open(fileobj=archive_bytes, mode="w") as archive:
+        payload = b"hello\n"
+        info = tarfile.TarInfo(name="note.txt")
+        info.size = len(payload)
+        archive.addfile(info, io.BytesIO(payload))
+    archive_payload = archive_bytes.getvalue()
+    header = json.dumps(
+        {
+            "workspace_path": "/workspace/note.txt",
+            "artifact_type": "file",
+            "archive_size": len(archive_payload),
+            "entry_count": 1,
+            "bytes_written": 6,
+        }
+    ).encode("utf-8") + b"\n"
+    stub = StubSocket(header + archive_payload)
+
+    def socket_factory(family: int, sock_type: int) -> StubSocket:
+        assert family == socket.AF_VSOCK
+        assert sock_type == socket.SOCK_STREAM
+        return stub
+
+    client = VsockExecClient(socket_factory=socket_factory)
+    archive_path = tmp_path / "export.tar"
+    response = client.export_archive(
+        1234,
+        5005,
+        workspace_path="/workspace/note.txt",
+        archive_path=archive_path,
+        timeout_seconds=60,
+    )
+
+    request = json.loads(stub.sent.decode("utf-8").strip())
+    assert request["action"] == "export_archive"
+    assert request["path"] == "/workspace/note.txt"
+    assert archive_path.read_bytes() == archive_payload
+    assert response.workspace_path == "/workspace/note.txt"
+    assert response.artifact_type == "file"
+    assert response.entry_count == 1
+    assert response.bytes_written == 6
+    assert stub.closed is True
+
+
 def test_vsock_exec_client_shell_round_trip(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr(socket, "AF_VSOCK", 40, raising=False)
     responses = [