Create run workspaces only when needed

docs/internal/workspace.md

@@ -45,6 +45,11 @@ file retains owner metadata after release or process death; its existence is
 not evidence that a lock is active. Command and restore flows wait for this
 lock only while their context remains active, and report a release failure.
 
+The runner assigns every invocation a run-workspace identity but creates the
+physical directory only before an executing stage that requires it. Fully
+reused invocations and cleanup-only invocations therefore do not accumulate
+empty run directories.
+
 ## Cleanup Semantics
 
 The canonical cleanup stage:

docs/policy/architecture.md

@@ -117,7 +117,10 @@ adapter and publish metadata.
 Resume and skip decisions are manifest-driven. Filesystem state may be
 inspected and validated, but file presence alone does not replace recorded
 stage state. Each invocation retains an in-memory command summary and a
-run-local working directory, but neither is a durable progress ledger.
+run-local workspace identity, but neither is a durable progress ledger. The
+physical run directory is created on demand only when an executing stage
+requires it; a fully reused invocation or a cleanup-only invocation does not
+leave an empty run directory.
 
 Restore treats committed remote current state as its authority. It must plan
 deterministically, confine remote-to-local paths, protect local conflicts, and