fix(trust): preserve workspace in generated guidance

[codeforester]

Summary

• Include the resolved workspace in generated trust allow commands.
• Include the same workspace context in review commands emitted by status and blocked-command guidance.
• Shell-quote generated command arguments so non-default workspaces and paths with spaces remain executable.

The current affected surface is base trust status and blocked guidance; workspace onboarding does not currently emit trust commands on main.

Issue

Fixes #2187

Validation

• env -u BASE_HOME BASE_CACHE_DIR=/private/tmp/base-issue-2187-cache PYTHONPATH=lib/python:cli/python /Users/rameshhp/.base.d/base/.venv/bin/python -m pytest -q cli/python/base_trust/tests/test_engine.py cli/python/base_trust/tests/test_command_error_paths.py
• 31 passed, 18 subtests passed
• git diff --check