refactor(desktop): register Goals and WorkHub controller owners

[chihumyum]

Summary

Goals and WorkHub already call their controllers below AppShell, but neither call site is registered in controllerOwners. Register useGoalController with GoalProvider and useWorkHubController with WorkHubRoot, each with one production call, so the existing architecture gate rejects additional callers, public controller exports, and removal of the ownership contract.

WorkHub's surface switch currently imports WorkHubRoot privately, which the owner contract rejects. Composition now supplies <WorkHubRoot /> through the public feature entry as the switch's WorkHub slot. Surface selection and the existing locale/Toast providers, appearance subscription, and ready notification retain their mount boundaries. The checker implementation and debt measurements are unchanged.

Refs #4582

Verification

• Fresh npm ci with Node 24.19.0 and npm 11.19.0; build, typecheck, lint, format, and Desktop/UI Knip passed.
• Architecture fixtures: 103/103. Architecture check against upstream/main passed; AppShell hook gate remains 40 hooks / 65 call sites.
• Desktop suite: 2,498/2,498. The two new surface tests verify exclusive mounting, locale propagation without remounting, Toast context, one ready notification, and subscription cleanup. Removing the Toast provider makes the new test fail.
• Temporary copies of the real source: for each controller, a second production caller and public export pass without registration and fail with it; removing either registration fails against the registered base (6/6 rejection checks). Restored source passes.
• Windows test inventory, ASF headers, Astryx inventory, and git diff --check passed.
• Rebased onto main 96f8e3f93; the upstream change touches only Runtime session trace projection. Its rebuilt tests, the focused Goals/WorkHub tests, and the architecture base check passed after rebase; range-diff is unchanged and merge-tree is clean.
• Electron E2E was not run locally; hosted CI runs it.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex implemented the registrations and composition adjustment, wrote tests, ran validation, and performed automated self-review. The commit carries a Generated-by: Codex trailer. Automated review is not independent human approval.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — the architecture gate now enforces the two existing controller owners; runtime product behavior is preserved.
• No