fix(oauth): clamp client ownership on single-workspace hosts

[Adityakk9031]

Summary

On single-workspace hosts (local/desktop), all connections are org-scoped (LOCAL_CONNECTION_OWNER = "org"). Previously, oauth.clients.create, oauth.clients.registerDynamic, and oauth.createClient accepted owner: "user" clients, but those clients were categorically unusable because local connections were org-scoped and the cross-owner guard rejected them with cloud-specific wording ("A Workspace connection must use a Workspace app.").

This PR:

1. Adds singleWorkspace?: boolean to ExecutorConfig (defaulting to true when subject === "local" or explicitly set).
2. Clamps owner: "user" to owner: "org" in createClient, registerDynamicClient, and core tools (oauth.clients.create, oauth.clients.registerDynamic, oauth.clients.createHandoff, oauth.clients.remove) on single-workspace hosts.
3. Allows local connections on single-workspace hosts to use existing/legacy client rows without throwing the cross-owner error.
4. Adds test coverage in packages/core/sdk/src/oauth-flow.test.ts and packages/core/sdk/src/executor.test.ts.

Closes #1850.

[Adityakk9031]

@RhysSullivan Hey, I noticed the six PRs were closed without any comments, so I wanted to understand what I should change for future contributions. Were the changes not aligned with the project's current direction, or is there a contribution process I should follow before opening PRs?

I’d appreciate any feedback so I can avoid submitting changes that aren't useful to the project.