Consolidate generateRefId into @corbits/error-sink

[TheGreatAxios]

Summary

• CL-7253: @workbench/hub-client's generateRefId (error-envelope.ts) and @corbits/error-sink's generateRefId (ref-id.ts) were byte-for-byte identical. Confirmed by direct diff, not by memory.
• Checked @intx/hub-common's generateId first per AGENTS.md before reimplementing anything: it mints {prefix}_{32 hex chars} for a fixed set of entity kinds (tenant, principal, session, ...), not a short human-quotable support refId — it doesn't cover this shape, so this isn't a case of an unnecessary reimplementation of a native primitive.
• @corbits/error-sink already owned the convention (per its own module comment, crediting packages/onboarding/src/routes.ts as the pattern it generalized), so it keeps the sole implementation; @workbench/hub-client now re-exports it instead of keeping a duplicate. No circular dependency: @corbits/error-sink only depends on @intx/log and arktype.
• Output format (${Date.now().toString(36)}-${random}) is unchanged, so no caller-visible refId format change.
• Checked for persisted-data impact: refIds from this function are only ever logged/quoted for support (grepped in log lines, shown in a "(ref X)" message) — never stored as a DB column or looked up by value. The principal.refId field elsewhere in the codebase is an unrelated concept (an auth-user identity), not this primitive.

Test plan

• bun run typecheck
• HUB_DATA_DIR=$(mktemp -d) bun test packages/hub-client packages/error-sink — 202 pass
• bunx prettier --check on touched files
• bun run check:structural (pre-existing check:report-error baseline violations only, unrelated to this change)