Add workspace-first roadmap milestones

Break the updated workspace vision into a checked-in roadmap from 2.4.0 through 3.1.0 so later implementation can be driven milestone by milestone.

Link the roadmap from the vision doc and keep each release slice scoped to one product capability, from the workspace contract pivot through shells, export/diff, services, snapshots, secrets, networking, and GA promotion.

This is a docs-only planning scaffold; runtime behavior stays unchanged in this commit.

docs/roadmap/task-workspace-ga/3.1.0-secondary-disk-tools.md

@@ -0,0 +1,41 @@
+# `3.1.0` Secondary Disk Tools
+
+## Goal
+
+Add the disk-level tools the vision explicitly places last, while keeping them
+secondary to the workspace identity.
+
+## Public API Changes
+
+Representative additions:
+
+- stopped-workspace disk export/import helpers
+- offline inspection helpers
+- disk-oriented snapshot inspection
+
+Exact command names should reinforce that these are supporting tools rather than
+the primary product contract.
+
+## Implementation Boundaries
+
+- keep these tools scoped to seeding, inspection, and offline workflows
+- do not replace shell, exec, services, diff, export, or reset as the main
+  interaction model
+- prefer explicit stopped-workspace or offline semantics
+
+## Non-Goals
+
+- no drift into generic image tooling identity
+- no replacement of workspace-level host crossing
+
+## Acceptance Scenarios
+
+- inspect or export a stopped workspace disk for offline analysis
+- import or snapshot content through disk-level tools without changing the main
+  workspace workflow
+
+## Required Repo Updates
+
+- docs that clearly mark disk tools as secondary
+- examples that show when disk tools are faster than a full boot
+- real smoke coverage for at least one offline inspection flow