[core-be-agent]

fix: Sanitize error messages to prevent information disclosure

- workspace_crud.go:335: Replace err.Error() with generic message
  to prevent leaking raw DB errors (e.g. pq syntax errors, table names)
- org.go:610: Replace fmt.Sprintf with body.Dir leak in 404 response

Both errors are already logged server-side; no observability lost.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

workspace-server/internal/handlers/org.go

@@ -607,7 +607,7 @@ func (h *OrgHandler) Import(c *gin.Context) {
 		orgFile := filepath.Join(orgBaseDir, "org.yaml")
 		data, err := os.ReadFile(orgFile)
 		if err != nil {
-			c.JSON(http.StatusNotFound, gin.H{"error": fmt.Sprintf("org template not found: %s", body.Dir)})
+			c.JSON(http.StatusNotFound, gin.H{"error": "org template not found"})
 			return
 		}
 		// Expand !include directives before unmarshal. Splits org.yaml

workspace-server/internal/handlers/workspace_crud.go

@@ -332,7 +332,7 @@ func (h *WorkspaceHandler) Delete(c *gin.Context) {
 	descendantIDs, stopErrs, err := h.CascadeDelete(ctx, id)
 	if err != nil {
 		log.Printf("Delete: CascadeDelete(%s) failed: %v", id, err)
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "internal error processing delete request"})
 		return
 	}
 	allIDs := append([]string{id}, descendantIDs...)