Document and validate Notarius extraction workflows

docs/internal/workspace.md

@@ -24,6 +24,14 @@ materialized into canonical session paths before stage success. Managed
 previous-session cache paths remain session-durable and are never redirected
 into run-local output space.
 
+Extraction uses run-local receipt, stderr, and output-root helpers, then
+promotes the validated external bundle to the unique immutable Notarius bundle
+path supplied by `internal/artifacts`. `internal/fileops.PromoteDirectory`
+copies only regular files and directories to a same-filesystem temporary
+sibling and atomically renames it without following symlinks or replacing an
+existing destination. Exact physical paths belong in
+[Operations](../operations.md#extraction-workflow).
+
 ## Locking
 
 `artifacts.LocalStore` enforces the single-writer session lock via `.lock`
@@ -54,9 +62,11 @@ deletion scope belong in [CLI](../cli.md#clean) and
 - Path model and local store: `internal/artifacts/paths.go`,
   `internal/artifacts/local.go`
 - Run-local materialization: `internal/stage/run_local.go`
+- Immutable bundle promotion: `internal/fileops/directory.go`
 - Cleanup confinement: `internal/app/cleanup_targets.go`,
   `internal/app/post_publish_cleanup.go`
 - Tests: `internal/artifacts/paths_model_test.go`,
   `internal/artifacts/local_test.go`, `internal/stage/run_local_test.go`,
+  `internal/fileops/directory_test.go`,
   `internal/app/cleanup_targets_test.go`,
   `internal/app/post_publish_cleanup_test.go`