Tower: overly broad workspace registrations (home dir, parent dirs) can hijack follow-focus #1392

Context

Live-hardware testing during #1347's dev-approval pass surfaced this (recorded in codev/reviews/1347-migrate-the-stream-deck-plugin.md, follow-up findings): Tower had workspaces registered at ~ and ~/repos/cluesmith — ancestors of the real workspace roots. Because path-based resolution matches any file under a registered root, an ancestor-scoped registration can capture events that belong to a nested real workspace and steer follow-focus (and any path-scoped routing) to the wrong workspace.

Questions to settle before fixing

1. How did ancestor registrations come to exist (accidental afx workspace start from the wrong cwd? adoption flow?) — prevention beats cleanup.
2. Should Tower refuse (or warn on) registering a workspace that is an ancestor or descendant of an existing one?
3. For resolution, should nested matches always prefer the deepest registered root (making stray ancestors harmless)?

Acceptance

A stray broad registration can no longer steal focus/events from a nested legitimate workspace, and the registration UX makes creating one either impossible or loudly deliberate.