feat: add preview-first workspace_edit tool

[mattjoyce]

Summary

• add a new workspace-native workspace_edit tool with regex_replace and line_replace modes
• default edits to preview mode (apply=false) and require expected_original_sha256 when apply=true
• enforce exactly one regex match for regex edits and validate line range edits
• apply changes atomically via temp-file + rename and include diff/hash metadata in responses
• add unit tests for preview/apply flow, single-match enforcement, line replacement, no-change, and apply hash requirement
• update prompt/docs (config.yaml, default act prompt, README`) and add/close kanban card #106

Testing

• go test ./...