feat(extension): P1 — WorkspaceWarden lifecycle + position invariant

Replace the workspace-warden.ts stub with a real implementation matching
design §5:

- On enable: snapshot org.gnome.mutter::dynamic-workspaces and
  org.gnome.desktop.wm.preferences::num-workspaces, persist to
  ~/.local/state/dashward/workspace-warden.json, then disable dynamic
  mode and append a new workspace as the dashboard slot. num-workspaces
  is updated to match the new count so external observers stay in sync.
- Position invariant: connect to workspace-manager's workspaces-reordered,
  workspace-added, and workspace-removed signals; whenever the dashboard
  is no longer last, reorder it back. If something external removes the
  dashboard, append a replacement.
- Defensive guards: external changes to num-workspaces or
  dynamic-workspaces are clamped back; a `suppressGuard` flag avoids
  feedback loops between our own writes and our own signal handlers.
- On disable: remove the dashboard workspace, restore both gsettings,
  delete the state file.

Supporting infrastructure:

- util/logger.ts: console.log/warn/error wrappers with [Dashward] prefix.
- util/state-store.ts: load/save/clear JSON state under XDG_STATE_HOME.
- types/globals.d.ts: minimal Shell.Global declaration covering
  workspace_manager / display / get_current_time().

Build chain fixes uncovered while wiring P1:

- Replace placeholder @girs/* versions in extension/ and container/
  package.json with real published versions from npm (gnome-shell@50.0.0,
  meta-16@16.0.0-4.0.0, etc.). Add the required @girs/gio/glib/gobject
  packages so resolution actually succeeds.
- Set tsconfig `types` arrays to include each girs `/ambient` entry so
  the `gi://*` and `resource:///*` module specifiers resolve.
- Add `override` modifiers on Extension.enable/disable (required under
  the base tsconfig's noImplicitOverride).
- Fix workspace iteration to use get_workspace_by_index in a loop
  instead of the non-existent get_workspaces() — Meta 16 doesn't expose
  the bulk getter.

Verified: `pnpm -r build` and `pnpm -r exec tsc --noEmit` are both clean.
Functional verification against a real GNOME session is pending P2 — the
extension cannot be loaded yet because we haven't packaged it for the
test VM.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

extension/package.json

@@ -9,8 +9,11 @@
     "dev": "node esbuild.config.js --watch"
   },
   "devDependencies": {
-    "@girs/gnome-shell": "48.0.0-next.1",
-    "@girs/meta-16": "16.0.0-next.1",
-    "@girs/gtk-3.0": "3.24.0-next.1"
+    "@girs/gnome-shell": "^50.0.0",
+    "@girs/meta-16": "^16.0.0-4.0.0",
+    "@girs/gtk-3.0": "^3.24.53-4.0.0",
+    "@girs/gio-2.0": "^2.88.0-4.0.0",
+    "@girs/glib-2.0": "^2.88.0-4.0.0",
+    "@girs/gobject-2.0": "^2.88.0-4.0.0"
   }
 }