fix(workspace): represent applied-but-blocked as a truthful third state

Provider-access reconciliation runs in the post-commit section of
apply_workspace, after relay/keys/scope have committed. The previous
.await? propagated any reconciliation failure as a command Err, causing
the frontend to treat the workspace as unapplied and clear appliedKey —
while the new scope was already active. This contradicted the
applied/degraded contract and the useCommunityInit error-handling
assumption.

Fix: replace .await? with a match that returns WorkspaceApplyResult
with applied: true and blocked: Some(reason) on reconciliation failure.
Dependent post-commit steps (event sync, agent restore) remain
unreached on this path, preserving #4053's fail-closed intent. The
frontend parks on the loading gate with a truthful error and the same
retry-by-reapply semantics as the catch block.

Changes:
- scope.rs: add blocked: Option<String> field to WorkspaceApplyResult,
  add applied_but_blocked() constructor, document the three states
- workspace.rs: replace .await? with match; return applied_but_blocked
  on reconciliation failure; update command doc comment
- useCommunityInit.ts: handle blocked after the !applied branch; update
  catch-block comment (reconcile failures no longer arrive as Err)
- tauri.ts: add blocked?: string | null to ApplyWorkspaceResult type
- e2eBridge.ts: add blocked: null to apply_workspace mock result
- runtime_commands_tests.rs: add three new tests covering the new state
  and the three-state distinction

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

desktop/src/testing/e2eBridge.ts

@@ -11135,10 +11135,15 @@ export function maybeInstallE2eTauriMocks() {
       case "fetch_join_policy":
         return activeConfig?.mock?.joinPolicy ?? null;
       case "apply_workspace": {
-        // Must return { applied: boolean, degraded: string[] } — useCommunityInit
-        // dereferences .applied and .degraded immediately after the await.
+        // Must return { applied: boolean, degraded: string[], blocked?: string | null }
+        // — useCommunityInit dereferences .applied, .degraded, and .blocked immediately
+        // after the await.
         const applyDelayMs = activeConfig?.mock?.applyCommunityDelayMs ?? 0;
-        const applyResult = { applied: true, degraded: [] as string[] };
+        const applyResult = {
+          applied: true,
+          degraded: [] as string[],
+          blocked: null,
+        };
         if (applyDelayMs > 0) {
           return new Promise((resolve) =>
             window.setTimeout(() => resolve(applyResult), applyDelayMs),