[P2.20] De-duplicate the ~300 lines of workspace DDL between create and upgrade paths

[frankbria]

Split out of #943 (AC3), which shipped the other three acceptance criteria. Not done there because it is a structural refactor of a module every CLI and server operation depends on, and that PR already changed schema-upgrade behaviour.

Problem

codeframe/core/workspace.py contains 28 CREATE TABLE IF NOT EXISTS statements, copy-pasted between _init_database (fresh workspace) and _ensure_schema_upgrades (existing workspace). The issue that spawned this noted they have already drifted.

Drift here is not cosmetic: a fresh workspace and an upgraded one end up with different schemas, and the difference only shows up as a runtime error on whichever path is less exercised.

_create_token_usage_schema already demonstrates the intended pattern — one function used by both paths, with a docstring saying exactly why.

Acceptance criteria

• Each table's DDL exists in exactly one place, called by both the create and upgrade paths
• A test asserts a freshly-created workspace and an upgraded one converge on the same schema (compare sqlite_master for both)
• No behaviour change: existing workspaces still open, new ones still initialise

Notes

• The convergence test is the valuable part — it makes future drift impossible rather than merely unlikely.
• Worth doing after [P1.25] Harden workspace DB integrity: foreign keys, safe UNIQUE index upgrade, single DDL, no control-plane contamination #943 merges, since that PR touches _ensure_schema_upgrades.

Why P2

No active failure — the duplication is a maintenance and drift hazard, not a bug users hit today. #943 fixed the parts that were.