fix: restore bounded agent sandbox execution

hub/deploy/README.md

@@ -15,6 +15,7 @@ Application code lives in immutable versioned directories under
 sudo BASE=/srv/curriculum-project-hub \
   HUB_DIR=/srv/curriculum-project-hub/releases/<release-id>/hub \
   INSTANCE_ID=org-a \
+  WORKSPACE_ROOT=/w/997 \
   PORT=8788 \
   MEMORY_MAX=16G CPU_QUOTA=400% TASKS_MAX=512 \
   bash /srv/curriculum-project-hub/releases/<release-id>/hub/deploy/install_service.sh
@@ -49,7 +50,7 @@ Default state paths are:
 ```text
 /var/lib/cph-hub/org-a/home
 /var/lib/cph-hub/org-a/state
-/var/lib/cph-hub/org-a/workspaces
+/w/997
 /var/cache/cph-hub/org-a
 ```