Image workspace storage

Defines contained output, runtime, and temporary-session storage for image workflows.

The policy uses the explicitly selected project, honors user destinations, and keeps installed plugin files read-only. Runtime setup and cleanup stay project-local and occur only when needed.