Add workspace-first roadmap milestones

Break the updated workspace vision into a checked-in roadmap from 2.4.0 through 3.1.0 so later implementation can be driven milestone by milestone.

Link the roadmap from the vision doc and keep each release slice scoped to one product capability, from the workspace contract pivot through shells, export/diff, services, snapshots, secrets, networking, and GA promotion.

This is a docs-only planning scaffold; runtime behavior stays unchanged in this commit.

docs/roadmap/task-workspace-ga/2.8.0-named-snapshots-and-reset.md

@@ -0,0 +1,42 @@
+# `2.8.0` Named Snapshots And Reset
+
+## Goal
+
+Turn reset into a first-class workflow primitive and add explicit named
+snapshots, not only the implicit create-time baseline.
+
+## Public API Changes
+
+- CLI:
+  - `pyro workspace snapshot create`
+  - `pyro workspace snapshot list`
+  - `pyro workspace snapshot delete`
+  - `pyro workspace reset WORKSPACE_ID [--snapshot SNAPSHOT_ID|baseline]`
+- SDK/MCP mirrors
+
+## Implementation Boundaries
+
+- Baseline snapshot is created automatically at workspace creation.
+- Named snapshots are explicit user-created checkpoints.
+- `workspace reset` recreates the full sandbox, not just `/workspace`.
+- Reset may target either the baseline or a named snapshot.
+
+## Non-Goals
+
+- no secrets in this milestone
+- no live host-sharing or mount semantics
+- no branching/merge workflow on snapshots
+
+## Acceptance Scenarios
+
+- mutate workspace, create named snapshot, mutate again, reset to snapshot,
+  confirm state restoration
+- mutate service and `/tmp` state, reset to baseline, confirm full sandbox
+  recreation
+- diff after reset is clean when expected
+
+## Required Repo Updates
+
+- docs that teach reset over repair explicitly
+- example showing baseline reset and named snapshot reset
+- real Firecracker smoke for snapshot create -> mutate -> reset