feat(cli): X7 (part) — workspace destroy teardown (spec 13)

[gustavobertoi]

What

Implements workspace destroy — the workspace-scoped, data-preserving core of spec-13 teardown.

How (destroyWorkspace)

1. compose downs every project stack (never -v — named volumes survive).
2. Drops this workspace's service_ref + port_alloc ledger rows under the flock.
3. Warm-stops any shared service now at zero refs via the existing tested Manager.GC(stop=true) — only services no other workspace references; volumes intact.
4. Removes generated .devstack/ artifacts (workspace shared + per project).

Machine-global state (shared network, local CA, alias symlinks) is left for other workspaces (spec 13 §destroy).

Safety

• Data loss gated by confirmation: --yes skips the prompt; --json requires --yes and fails fast before touching Docker.
• Best-effort: a failure on one project is recorded, the rest proceed, and a non-zero exit reports the count — a partially-broken workspace can still be cleaned.
• Teardown mechanics factored into destroyWorkspace(...) so they unit-test with injected mocks (no daemon).

Tests

internal/cli/destroy_test.go: command registration; --json requires --yes; full teardown (compose down per project & never --volumes, ref + port rows cleared, orphaned shared warm-stopped on devstack-shared, .devstack/ removed). make ci green.

Spec acceptance (spec 13)

• workspace destroy removes this workspace's stacks + ref/port rows while leaving the shared network + CA intact.
• requires explicit confirmation for data loss; --yes skips; --json emits a machine-readable result.

Deferred (remaining X7): --purge-data (shared per-service named-volume removal needs a docker volume rm capability not in the read-only client) and uninstall (machine-global teardown incl. CA removal across host/Firefox/Windows stores).

🤖 Generated with Claude Code