chore: final open-source cleanup — binary, stale paths, private refs

- Remove compiled workspace-server/server binary from git
- Fix .gitignore, .gitattributes, .githooks/pre-commit for renamed dirs
- Fix CI workflow path filters (workspace-template → workspace)
- Replace real EC2 IP and personal slug in test_saas_tenant.sh
- Scrub molecule-controlplane references in docs
- Fix stale workspace-template/ paths in provisioner, handlers, tests
- Clean tracked Python cache files

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitignore

@@ -1,6 +1,6 @@
 # Binaries
-platform/server
-platform/molecli
+workspace-server/server
+workspace-server/molecli
 *.exe
 *.out
 *.bin
@@ -87,7 +87,7 @@ redis_data/
 workspace-configs-templates/ws-*
 
 # Local dev cruft — provisioner writes here at runtime; templates live at repo root
-platform/workspace-configs-templates/
+workspace-server/workspace-configs-templates/
 
 # Codex/Gemini agent skill cache (local only, not authoritative)
 .agents/