Add workspace-first roadmap milestones

Break the updated workspace vision into a checked-in roadmap from 2.4.0 through 3.1.0 so later implementation can be driven milestone by milestone.

Link the roadmap from the vision doc and keep each release slice scoped to one product capability, from the workspace contract pivot through shells, export/diff, services, snapshots, secrets, networking, and GA promotion.

This is a docs-only planning scaffold; runtime behavior stays unchanged in this commit.

docs/roadmap/task-workspace-ga/3.0.0-stable-workspace-product.md

@@ -0,0 +1,37 @@
+# `3.0.0` Stable Workspace Product
+
+## Goal
+
+Freeze the workspace-first public contract and promote the product from a
+one-shot runner with extras to a stable agent workspace.
+
+## Public API Changes
+
+No new capability is required in this milestone. The main change is stability:
+
+- workspace-first names are the only public contract
+- shell, sync, export, diff, services, snapshots, reset, secrets, and network
+  policy are all part of the stable product surface
+
+## Implementation Boundaries
+
+- remove remaining beta/alpha language from workspace docs
+- rewrite landing docs so the workspace product is first-class and `pyro run`
+  is the entry point rather than the center
+- lock the stable contract in `docs/public-contract.md`
+
+## Non-Goals
+
+- no new secondary tooling
+- no job-runner, queue, or CI abstractions
+
+## Acceptance Scenarios
+
+- all core vision workflows are documented and runnable from CLI, SDK, and MCP
+- the repo no longer presents the workspace model as provisional
+
+## Required Repo Updates
+
+- top-level README repositioning around the workspace product
+- stable public contract doc for `3.x`
+- changelog entry that frames the workspace product as stable