Add workspace-first roadmap milestones

Break the updated workspace vision into a checked-in roadmap from 2.4.0 through 3.1.0 so later implementation can be driven milestone by milestone.

Link the roadmap from the vision doc and keep each release slice scoped to one product capability, from the workspace contract pivot through shells, export/diff, services, snapshots, secrets, networking, and GA promotion.

This is a docs-only planning scaffold; runtime behavior stays unchanged in this commit.

docs/roadmap/task-workspace-ga/2.4.0-workspace-contract-pivot.md

@@ -0,0 +1,70 @@
+# `2.4.0` Workspace Contract Pivot
+
+## Goal
+
+Make the public product read as a workspace-first sandbox instead of a
+task-flavored alpha by replacing the `task_*` surface with `workspace_*`.
+
+## Public API Changes
+
+- CLI:
+  - `pyro workspace create`
+  - `pyro workspace sync push`
+  - `pyro workspace exec`
+  - `pyro workspace status`
+  - `pyro workspace logs`
+  - `pyro workspace delete`
+- SDK:
+  - `create_workspace`
+  - `sync_push_workspace`
+  - `exec_workspace`
+  - `status_workspace`
+  - `logs_workspace`
+  - `delete_workspace`
+- MCP:
+  - `workspace_create`
+  - `workspace_sync_push`
+  - `workspace_exec`
+  - `workspace_status`
+  - `workspace_logs`
+  - `workspace_delete`
+
+Field renames:
+
+- `task_id` -> `workspace_id`
+- `source_path` on create -> `seed_path`
+- `task.json` / `tasks/` -> `workspace.json` / `workspaces/`
+
+No compatibility aliases. Remove `task_*` from the public contract in the same
+release.
+
+## Implementation Boundaries
+
+- Keep current behavior intact under the new names:
+  - persistent workspace creation
+  - create-time seed
+  - sync push
+  - exec/status/logs/delete
+- Rename public result payloads and CLI help text to workspace language.
+- Move on-disk persisted records to `workspaces/` and update rehydration logic
+  accordingly.
+- Update examples, docs, and tests to stop using task terminology.
+
+## Non-Goals
+
+- no shell sessions yet
+- no export, diff, services, snapshots, reset, or secrets in this release
+- no attempt to preserve old CLI/SDK/MCP names
+
+## Acceptance Scenarios
+
+- create a seeded workspace, sync host changes into it, exec inside it, inspect
+  status/logs, then delete it
+- the same flow works from CLI, SDK, and MCP with only workspace-first names
+- one-shot `pyro run` remains unchanged
+
+## Required Repo Updates
+
+- replace task language in README/install/first-run/public contract/help
+- update runnable examples to use `workspace_*`
+- add one real Firecracker smoke for create -> sync push -> exec -> delete