Alloy multi-tenancy Phase 1 (partial) — queries.ts converted, actions.ts redo needed

products/alloy/lib/workspace-context.ts — NEW file. WorkspaceContext type, requireSoleWorkspaceContext() (fail-closed temporary bridge resolver per Zeb-approved external design review: throws on 0 or 2+ active memberships, never picks one implicitly), requireWorkspaceContext(workspaceId) (the canonical future route-selected resolver), listActiveMembershipsForCurrentActor(). Verified complete and correct on disk.

products/alloy/lib/db/queries.ts — every non-deferred function (38 conversions across ~30 exported functions) converted from bare ownerId:string params to ctx:WorkspaceContext, filtering by workspaceId instead of ownerId. Verified complete: exactly 7 functions remain on ownerId, and all 7 are the deliberately-deferred concurrency-sensitive raw-SQL fencing group named in this file's own header comment (getForgeConductSnapshot, reconcileStaleRunnerLeases, reconcileUnclaimedCommands, getProviderSessionBinding, getRunnerPresence, getExecutionForCommand, reconcileExecutionTerminal) — confirmed via grep against the live file, not assumed.