pub fn workspace_hash(workspace: &Path) -> String
12-char workspace hash. Stable across calls for the same canonical path. Public for diagnostics.