fix(desktop): audit workspace routes too, and cover the three that bypass the chrome

Greptile was right that the blanket `workspace/` exclusion was load-bearing in the wrong
direction. It assumed every workspace route reaches the lane through `WorkspaceChrome`,
and three do not: the workspace landing route, the access-denied early return, and the
workflow error boundary.

The exclusion is gone, so workspace files are audited like everything else and
`WorkspaceChrome` joins the lane-aware shells — the normal route passes through its
layout, and the three exceptions had to be dealt with on their merits:

- the landing route (status card and spinner) and access-denied now reserve the lane;
- the error boundary is allowlisted, verified: it renders `<Sidebar>`, which already owns
  the workspace lane and its drag region, so padding that root would double it.

Their content was centred, so the lights were never covering text — the real gap was that
none of them rendered a drag strip, leaving the window immovable on those screens.

The guard's granularity is per file, not per JSX root: `workspace/page.tsx` holds two
full-viewport roots and still passes if only one reserves the lane. Verified by mutation
and documented rather than papered over — catching it needs an AST pass, and the check's
job is to stop a whole surface being forgotten, which is how every instance of this bug
has actually shipped.

Author: waleedlatif1

apps/sim/app/_shell/desktop-title-bar-surfaces.test.ts

@@ -172,13 +172,22 @@ describe('desktop title-bar surface audit', () => {
  *
  * So the check enumerates instead of listing what to look at: any new full-viewport root
  * fails here until it either composes `.desktop-title-bar-page` or is added below with a
- * reason. Reaching for this allowlist should feel like a claim you have to defend.
+ * reason. Reaching for this allowlist should feel like a claim you have to defend — the
+ * entry that read "marketing chrome, not reachable in the desktop shell" was false, and
+ * hid four live surfaces behind one unverified sentence.
+ *
+ * Granularity is per FILE, not per JSX root: a file holding two full-viewport roots still
+ * passes if only one reserves the lane. Catching that needs an AST pass, which is not
+ * worth the weight here — the check's job is to stop a whole surface being forgotten,
+ * which is how every instance of this bug actually shipped.
  */
 const LANE_EXEMPT: Record<string, string> = {
   'app/(landing)/components/landing-shell/landing-shell.tsx':
     'Marketing chrome. Verified: every consumer lives under app/(landing)/, and the desktop shell boots to /login or a workspace with no path to those routes.',
   'app/playground/page.tsx':
     'Verified dev-only: the page calls notFound() unless NEXT_PUBLIC_ENABLE_PLAYGROUND is set.',
+  'app/workspace/[workspaceId]/w/[workflowId]/components/error/index.tsx':
+    'Renders <Sidebar>, which owns the workspace lane and its drag region (sidebar.tsx). Padding this root too would double the reservation.',
 }
 
 /**
@@ -188,13 +197,13 @@ const LANE_EXEMPT: Record<string, string> = {
  * shell's own definition file mentioning its name, would otherwise self-certify as
  * covered. Both mistakes were in the first draft of this check and made it unfailable.
  */
-const LANE_AWARE_SHELL_USAGE = /<(AuthShell|LogoShell)\b/
+const LANE_AWARE_SHELL_USAGE = /<(AuthShell|LogoShell|WorkspaceChrome)\b/
 
 describe('desktop traffic-light lane coverage', () => {
   it('leaves no full-viewport root outside workspace chrome unaccounted for', () => {
     const appDir = new URL('../', import.meta.url)
     const files = readdirSync(appDir, { recursive: true, encoding: 'utf8' })
-      .filter((f) => f.endsWith('.tsx') && !f.startsWith('workspace/'))
+      .filter((f) => f.endsWith('.tsx'))
       .map((f) => `app/${f}`)
 
     const unaccounted = files.filter((file) => {

apps/sim/app/workspace/[workspaceId]/components/workspace-access-denied.tsx

@@ -1,9 +1,11 @@
 import { ChipLink } from '@sim/emcn'
 import { CircleAlert } from '@sim/emcn/icons'
+import { DesktopTitleBarLane } from '@/app/_shell/desktop-title-bar'
 
 export function WorkspaceAccessDenied() {
   return (
-    <main className='flex min-h-screen items-center justify-center bg-[var(--surface-1)] p-6'>
+    <main className='desktop-title-bar-page flex items-center justify-center bg-[var(--surface-1)] p-6'>
+      <DesktopTitleBarLane />
       <div className='flex max-w-md flex-col items-center gap-3 text-center'>
         <div className='flex size-10 items-center justify-center rounded-full bg-[var(--surface-3)]'>
           <CircleAlert className='size-[18px] text-[var(--text-icon)]' aria-hidden />

apps/sim/app/workspace/page.tsx

@@ -12,6 +12,7 @@ import { createWorkspaceContract } from '@/lib/api/contracts/workspaces'
 import { useSession } from '@/lib/auth/auth-client'
 import { recoverFromStaleSession } from '@/lib/auth/stale-session-recovery'
 import { WorkspaceRecencyStorage } from '@/lib/core/utils/browser-storage'
+import { DesktopTitleBarLane } from '@/app/_shell/desktop-title-bar'
 import { useWorkspacesWithMetadata } from '@/hooks/queries/workspace'
 
 const logger = createLogger('WorkspacePage')
@@ -44,7 +45,8 @@ function WorkspaceStatusCard({
   onPrimary,
 }: WorkspaceStatusCardProps) {
   return (
-    <main className='flex h-screen w-full items-center justify-center bg-[var(--surface-1)] p-6'>
+    <main className='desktop-title-bar-page flex w-full items-center justify-center bg-[var(--surface-1)] p-6'>
+      <DesktopTitleBarLane />
       <div className='flex max-w-md flex-col items-center gap-3 text-center'>
         <div className='flex size-10 items-center justify-center rounded-full bg-[var(--surface-3)]'>
           <CircleAlert className='size-[18px] text-[var(--text-icon)]' aria-hidden />
@@ -201,7 +203,8 @@ export default function WorkspacePage() {
   }
 
   return (
-    <div className='flex h-screen w-full items-center justify-center'>
+    <div className='desktop-title-bar-page flex w-full items-center justify-center'>
+      <DesktopTitleBarLane />
       <div
         className='size-[18px] animate-spin rounded-full'
         style={{