fix(registry): auto-recover failed/provisioning workspaces on successful heartbeat

[HongmingWang-Rabbit]

Summary

Extracted from closed PR #1664. When a workspace is stuck in failed or provisioning state but is actively sending successful heartbeats, the heartbeat handler now transitions it to online. Transient boot failures or a provisioner crash mid-setup previously left workspaces marked failed even after they became healthy, requiring manual intervention.

Problem

• A flaky boot or a provisioner that crashes mid-setup leaves workspaces.status = 'failed' (or stale 'provisioning') in the DB.
• The workspace subsequently comes up and begins sending heartbeats, but evaluateStatus only handled the online -> degraded, degraded -> online, and offline -> online transitions.
• Result: the scheduler and dashboard keep reporting the workspace as dead despite it being healthy. Users have to manually reset status or delete-and-recreate.

Fix

In workspace-server/internal/handlers/registry.go::evaluateStatus, after the existing offline recovery block, add a new branch:

if currentStatus == "failed" || currentStatus == "provisioning" {
    // UPDATE workspaces SET status = 'online' ... WHERE id = $1 AND status IN ('failed', 'provisioning')
    // broadcast WORKSPACE_ONLINE with recovered_from=<prev status>
}

• Same WHERE status IN (...) guarded UPDATE pattern as the existing offline-recovery block, so a concurrent delete that flips to removed cannot race the recovery back to online.
• Existing online, degraded, and offline transitions are untouched.
• Broadcasts WORKSPACE_ONLINE with a recovered_from payload field so the UI/event log can distinguish auto-recovery from first-time online.

Test plan

• go build ./... in workspace-server/ passes cleanly.
• go test ./internal/handlers/... -count=1 -run "TestRegistry|TestHeartbeat|TestRegister" — the only failures (TestRegister_C18_HijackBlockedNoBearer, TestRegister_ProvisionerURLPreserved) reproduce on origin/main without this patch, confirmed pre-existing and unrelated.
• Manual: force status = 'failed' on a running workspace, confirm next heartbeat flips to 'online' and emits WORKSPACE_ONLINE with recovered_from: "failed".
• Manual: force status = 'provisioning' on a running workspace, confirm same behaviour with recovered_from: "provisioning".
• Verify removed workspaces are NOT revived (guarded by the status IN ('failed', 'provisioning') predicate in the UPDATE).

Scope: workspace-server/internal/handlers/registry.go only.