Document completed workspace behavior

docs/config.md

@@ -67,6 +67,10 @@ workspace:
     enabled: false
 ```
 
+`workspace.directory` is unset by default. Without a workspace directory,
+diagnostics continue to use `/tmp/notarius`, and checkpoint and debug workspace
+features have no storage root.
+
 No pipelines are built in. A run requires a configured pipeline.
 
 If `scriptorium` is omitted, Notarius uses Scriptorium's built-in profile
@@ -352,12 +356,40 @@ casts still must be present in the source transcript.
 - `resume.enabled`: boolean resume checkpointing setting. Default: `false`.
 - `debug.enabled`: boolean debug artifact setting. Default: `false`.
 
-When `workspace.resume.enabled` is true, runs write stage-owned checkpoint
-artifacts under `<workspace.directory>/checkpoints/`. `notarius run --resume`
-can reuse valid checkpoints from a compatible invocation.
+Use `/var/lib/notarius` as the standard production workspace directory. For
+local development, prefer a project-local ignored path such as
+`./.notarius/workspace`.
 
-When `workspace.debug.enabled` is true, runs write per-invocation debug
-artifacts under `<workspace.directory>/debug/<run-id>/`.
+```yaml
+workspace:
+  directory: /var/lib/notarius
+  diagnostics:
+    enabled: true
+    retention: auto
+  resume:
+    enabled: false
+  debug:
+    enabled: false
+```
+
+When `workspace.directory` is set, diagnostics are written under
+`<workspace.directory>/diagnostics/`.
+
+When both `workspace.directory` and `workspace.resume.enabled` are set, runs
+write stage-owned checkpoint artifacts under
+`<workspace.directory>/checkpoints/`. `notarius run --resume` can reuse valid
+checkpoints from a compatible invocation. Checkpoints may contain source text,
+intermediate raw outputs, rejected outputs, metadata, and warnings. Protect the
+workspace as sensitive local state.
+
+When both `workspace.directory` and `workspace.debug.enabled` are set, runs
+write per-invocation debug artifacts under
+`<workspace.directory>/debug/<run-id>/`. Debug artifacts may contain source
+material, reference material, prompt inputs, model outputs, validation payloads,
+and other sensitive content. Debug is disabled by default.
+
+`workspace.resume.enabled` and `workspace.debug.enabled` are independent.
+Enabling one does not enable the other.
 
 ## Diagnostics
 
@@ -380,6 +412,11 @@ set.
 - `retention`: deprecated compatibility retention mode. `auto`, `always`, or
   `never`. Empty uses `auto`.
 
+Existing `diagnostics.work_dir`, `diagnostics.retention`, `NOTARIUS_WORK_DIR`,
+and `NOTARIUS_DIAGNOSTICS_RETENTION` inputs remain supported for compatibility.
+New configuration should use `workspace.directory` and
+`workspace.diagnostics.retention` instead.
+
 `auto` retains diagnostics for failed runs and successful runs with warnings.
 `always` retains diagnostics for every run. `never` removes diagnostics for
 successful runs without regard to warnings; failed runs are retained.