Group sidebar sessions by space and support confirmed space removal

Replace the disconnected Spaces and global Sessions sidebar lists with one scrollable, collapsible space/session hierarchy. Show space directory context to disambiguate duplicate names, compact per-session tab/split context rather than prominent PID diagnostics, clear selection, and existing unread completion highlights including collapsed-space attention. Reuse Workspace ownership/selection and Qt/KDE palette/controls. Preserve terminal processes when navigating/collapsing. User clarified removal means removing a SPACE, not adding session-close buttons; removing a populated space must stop all its sessions after explicit confirmation. Add a discoverable space-header removal action and a confirmation naming the space, directory and terminal count. Reuse closePane/RemoteSession close acknowledgement; retain background panes/space/saved IDs until acknowledged and refuse disconnected removal without forgetting running work. Prevent new starts in a space while removal is pending. Other spaces/processes must remain untouched. Permit removing the last space into an empty, persistable no-process state with an Add space action. Safety: no active Canopy window/service restart, user state/socket reuse, dependency/protocol changes, command replay, commit or push. Use private fixtures and virtual KWin. Collapse/removal-progress state is transient, not saved; persisted layout decoding remains bounded/transactional. Document empty-layout compatibility if the version-1 decoder is relaxed. Acceptance: grouped navigation assigns every pane exactly once to its space in tab/split order; duplicate names have path context; selected/attention/collapse behavior remains correct; space removal requires confirmation, Cancel is nondestructive, confirmed removal stops only its sessions and waits for service acknowledgement, disconnection retains identities and permits recovery, pending spaces reject launches, and final-space removal round-trips without auto-launch. Backend/service/layout and private native UI regressions pass, screenshots inspected at normal/minimum widths and with overflowing spaces. Implementation: Workspace.spaces exposes sessions in tab/tree order with Pane references and tab/pane context. WorkspaceSidebar.qml provides one scroll region, directory labels, transient collapse state, selected-vs-unread palette treatment, collapsed-space attention and a per-space trash action. Main has a count/name/path confirmation, no-space Add space state and disabled unavailable starts. No session-close actions were added to the sidebar after the user's correction. Removal marks the target transiently removing, preflights background connectivity, closes through existing acknowledgement paths, blocks starts/splits/restored starts, and removes metadata only after the last pane is gone. A close-send failure clears removal progress and reports the existing error; an interruption retains IDs for reconnection. Last-space removal accepts/persists empty version-1 layouts (selection zero only), documented as rejected/preserved by older decoders. No service/wire/upstream patch changes. Validation milestone: seven CTest suites and private native virtual-KWin suite (16 QtTest rows including setup/cleanup) pass. Screenshots inspected for grouped duplicate names/paths, selected vs unread attention, collapsed summary, minimum width, overflow, removal confirmation and empty state. UI tests cover Cancel/confirmation for local and background terminals. Service tests cover multi-pane ack retention, blocked starts, disconnected refusal, reconnect after close interruption and closure before creation reply; layout and executable ordinary-empty startup tests pass. All fixtures are private; active Canopy/service unchanged. Static review found an empty-startup regression: an explicit command or --image-check failed without a space. Executable red controls reproduced both while ordinary startup passed. Reused startup space creation for explicit launches only; all three cases now pass. Reviewers did not execute tests and could not inspect upstream Kwi close internals. Final ./scripts/build.sh passes, all seven CTest suites pass (service suite includes ordinary/explicit-command/explicit-image empty-layout startup rows), and the private native suite passes 16 QtTest rows with no failures/skips. C++/QML formatting, compiler-warning scan, whitespace and private-metadata checks pass. Normal/minimum/overflow/collapsed-attention/confirmation/empty captures were visually inspected. Desktop activation/notifications remain covered by existing tests, not newly certified on the real desktop. No user state or real service was touched. Changes remain uncommitted on feature/group-sessions-by-space. Scope: user's later rails s → ruby observation concerns original shell-command labels. Explained executable identity vs shell provenance and credential exposure; shell hooks/argv display remain a separate follow-up, not part of this patch.