Fix config-scoped state and unchanged checkpoints

[abrookins]

Summary

This fixes two QA failures that were both caused by surface-level contract drift.

First, afs fs create-exclusive respected the selected config file for Redis/workspace settings, but it still loaded runtime state from the legacy global ~/.afs/state.json. That meant an alternate --config could point at the right workspace and still read the wrong sync runtime state, which broke create-exclusive in exactly the kind of copied-config test flow QA was exercising.

Second, unchanged-workspace checkpoint creation behaved differently across surfaces. The CLI already treated an unchanged live workspace as a valid explicit checkpoint create, but the MCP checkpoint tools did not opt into that behavior. In practice that meant SDK users could call checkpoint_create, get back a checkpoint name with created: false, and then immediately hit a restore failure because that named checkpoint had never actually been written.

Those are both bad inconsistencies: the CLI path becomes config-sensitive in the wrong places, and the checkpoint contract changes depending on whether the caller goes through CLI or MCP/SDK.

What Changed

• added config-scoped runtime state files for non-default config paths, with legacy fallback for migration
• kept the default config on the legacy ~/.afs/state.json path so the normal CLI flow does not move unexpectedly
• added a regression proving fs create-exclusive ignores a conflicting legacy state file when the selected config has its own runtime state
• aligned local MCP and hosted MCP checkpoint_create with the CLI contract by allowing unchanged explicit checkpoint saves
• fixed the local live-workspace save path so AllowUnchanged is honored before the clean-workspace short-circuit
• added local MCP, hosted MCP, Python SDK, and TypeScript SDK regressions for unchanged checkpoint create/restore behavior

Testing

• go test ./cmd/afs -run 'TestCmdFileCreateExclusiveRoundTrip|TestCmdFileCreateExclusiveUsesConfigScopedState|TestAFSMCPCheckpointCreateAllowsUnchangedWorkspace'
• go test ./internal/controlplane -run TestHostedMCPCheckpointCreateAllowsUnchangedWorkspace
• go test ./cmd/afs ./internal/controlplane
• PYTHONPATH=src uv run python -m unittest tests.test_client
• npm test in sdk/typescript
• make test

[jit-ci]

🛡️ Jit Security Scan Results

✅ No security findings were detected in this PR

---

^{Security scan by Jit}