feat(herdr): one workspace per project, agent panes named for the work

[stoneevenson-biz]

The rule

When the crew runs on herdr:

• every project gets its own workspace, labelled with the project name
• every agent pane is named for the work it is doing, not for a task id

This isn't tidiness. herdr addresses agents by name — herdr agent prompt <name> "..." — so the name is the address. afs-resources-r7 tells you nothing at a glance; afs/resource-registry tells you what the pane is for without attaching to it, and makes the whole fleet readable from the workspace list alone.

afs/resource-registry       cellarsky/booking-fix
afs/doc-index               mac-config/cutover-guard
stone-skills/lint-edges

Kebab-case, under ~28 chars, no task suffix — the id belongs in state/<id>.meta, which is where ids live.

bin/fm-herdr-workspaces.sh

invocation	effect
(no args)	print a plan, change nothing
--apply	create only the workspaces that are absent
--name <target> <project> <work>	apply the convention to a live pane

Plan mode is the default — a tool that mutates on invocation is a tool people stop running. A registry line whose project directory doesn't exist is reported NO-DIR rather than silently created.

Refusals are actionable: a stopped server says to run herdr; a missing registry says which path it wanted.

Verification

Falsifiable — removing the length cap turns the overlong-name case red:

not ok - an overlong name was accepted

suite            8/8
full suite       38 pass, 1 fail
shellcheck       clean

The one failure, fm-loop-l2, fails identically at 24f6891 — unrelated.

AGENTS.md gains six lines pointing at the script rather than restating it, since that file is already well over its own documented size budget.