Add --workspace-root so v2 file keys are repo-relative #274

Goal

Add an optional --workspace-root <dir> flag. When it's set, v2 file keys are relative to the workspace root instead of --input. For example, a project at services/orders/ in a monorepo produces services/orders/src/main/java/.../App.java, which git, IDEs and scanners can match directly.

Spec: docs/design/specs/2026-10-24-workspace-root.md (on branch feat/add-workspace-root)

Goals

• Add the --workspace-root option. Unset, the root is --input and output is byte-identical to today's.
• Use the root for symbol_table keys (L1Extractor.fileKey), module ids and every id below them, and artifact keys/ids (ArtifactDiscovery).
• Keep the app segment as it is (--app-name, else the --input dir name).
• Hard error if --input isn't inside the workspace root.
• Hard error if the flag is used with --schema v1.
• Test that no key is absolute or contains .. (including CanId.moduleId's leading-./ stripping).

Definition of done

• A nested-fixture test covers L1, L2 (call-graph ids) and L3 overlay ids.
• Neo4j incremental push works with the flag (the prefix wipe/prune stays scoped to the app).
• README documents the flag, the repo-relative keys, and that toggling the flag misses the cache.
• Released in 3.4.0.