fix(workspace-server): skip provision pipeline on Restart for runtime=external

[HongmingWang-Rabbit]

Summary

• Manual `POST /workspaces/:id/restart` on a `runtime=external` workspace ran the full re-provision pipeline → `issueAndInjectToken` → `RevokeAllForWorkspace`, silently destroying the operator's local bearer token on every Restart click.
• Auto-restart (`runRestartCycle`, line 436) already short-circuits external — this patch mirrors that for the manual handler so the two paths agree.
• Returns `200 OK` with `{status: noop, runtime: external, message: ...}` so the canvas can show the operator that the fix is on their side rather than silently no-op'ing.

Why this matters

Reported during this session: I was running the molecule MCP channel plugin against a long-lived external workspace, the canvas surfaced "workspace dead — restart?", clicking Restart silently revoked my token, and my poller 401-spammed until I manually regenerated from the Tokens tab. Every external workspace operator hits this the first time their canvas suggests a restart.

Test plan

• `go test ./internal/handlers/ -run TestRestartHandler -count=1` — 5/5 pass including the new `TestRestartHandler_ExternalRuntimeNoOps`
• `go test ./internal/handlers/ -count=1` — full handlers suite green
• sqlmock asserts no DB writes occur after the short-circuit (token revoke / status update would trigger an "unexpected query" failure)
• Verify on staging once merged: hit `/workspaces/:external-id/restart` on a tenant with a live external workspace, confirm `status=noop` response and the local poller's token still works

🤖 Generated with Claude Code