Add workspace service lifecycle with typed readiness

Make persistent workspaces capable of running long-lived background processes instead of forcing everything through one-shot exec calls.

Add workspace service start/list/status/logs/stop across the CLI, Python SDK, and MCP server, with multiple named services per workspace, typed readiness probes (file, tcp, http, and command), and aggregate service counts on workspace status. Keep service state and logs outside /workspace so diff and export semantics stay workspace-scoped, and extend the guest agent plus backends to persist service records and logs across separate calls.

Update the 2.7.0 docs, examples, changelog, and roadmap milestone to reflect the shipped surface.

Validation: uv lock; UV_CACHE_DIR=.uv-cache make check; UV_CACHE_DIR=.uv-cache make dist-check; real guest-backed Firecracker smoke for workspace create, two service starts, list/status/logs, diff unaffected, stop, and delete.

CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable user-visible changes to `pyro-mcp` are documented here.
 
+## 2.7.0
+
+- Added first-class workspace services across the CLI, Python SDK, and MCP server with
+  `pyro workspace service *`, `Pyro.start_service()` / `list_services()` / `status_service()` /
+  `logs_service()` / `stop_service()`, and the matching `service_*` MCP tools.
+- Added typed readiness probes for workspace services with file, TCP, HTTP, and command checks so
+  long-running processes can be started and inspected without relying on shell-fragile flows.
+- Kept service state and logs outside `/workspace`, and surfaced aggregate service counts from
+  `workspace status` without polluting workspace diff or export semantics.
+
 ## 2.6.0
 
 - Added explicit host-out workspace operations across the CLI, Python SDK, and MCP server with