Add chat-first workspace roadmap

Document the post-3.1 milestones needed to make the stable workspace product feel natural in chat-driven LLM interfaces.

Add a follow-on roadmap for model-native file ops, workspace naming and discovery, tool profiles, shell output cleanup, and use-case recipes with smoke coverage. Link it from the README, vision doc, and completed workspace GA roadmap so the next phase is explicit.

Keep the sequence anchored to the workspace-first vision and continue to treat disk tools as secondary rather than the main chat-facing surface.

docs/roadmap/llm-chat-ergonomics/3.2.0-model-native-workspace-file-ops.md

@@ -0,0 +1,59 @@
+# `3.2.0` Model-Native Workspace File Ops
+
+Status: Planned
+
+## Goal
+
+Remove shell quoting and hidden host-temp-file choreography from normal
+chat-driven workspace editing loops.
+
+## Public API Changes
+
+Planned additions:
+
+- `pyro workspace file list WORKSPACE_ID [PATH] [--recursive]`
+- `pyro workspace file read WORKSPACE_ID PATH [--max-bytes N]`
+- `pyro workspace file write WORKSPACE_ID PATH --text TEXT`
+- `pyro workspace patch apply WORKSPACE_ID --patch TEXT`
+- matching Python SDK methods:
+  - `list_workspace_files`
+  - `read_workspace_file`
+  - `write_workspace_file`
+  - `apply_workspace_patch`
+- matching MCP tools:
+  - `workspace_file_list`
+  - `workspace_file_read`
+  - `workspace_file_write`
+  - `workspace_patch_apply`
+
+## Implementation Boundaries
+
+- scope all operations strictly under `/workspace`
+- keep these tools text-first and bounded in size
+- make patch application explicit and deterministic
+- keep `workspace export` as the host-out path for copying results back
+- keep shell and exec available for process-oriented work, not as the only way
+  to mutate files
+
+## Non-Goals
+
+- no arbitrary host filesystem access
+- no generic SFTP or file-manager product identity
+- no replacement of shell or exec for process lifecycle work
+- no hidden auto-merge behavior for conflicting patches
+
+## Acceptance Scenarios
+
+- an agent reads a file, applies a patch, reruns tests, and exports the result
+  without shell-escaped editing tricks
+- an agent inspects a repo tree and targeted files inside one workspace without
+  relying on host-side temp paths
+- a repro-plus-fix loop is practical from MCP alone, not only from a custom
+  host wrapper
+
+## Required Repo Updates
+
+- public contract updates across CLI, SDK, and MCP
+- docs and examples that show model-native file editing instead of shell-heavy
+  file writes
+- at least one real smoke scenario centered on a repro-plus-fix loop