refactor(workspace): mount CWD as /workspace instead of named volume

Run from the project directory you want to work on; claude.sh mounts
it automatically. Removes WORKSPACE_DIR env var support and the
named claude-secure-workspace Docker volume.

claude.sh

@@ -43,20 +43,9 @@ load_env() {
 }
 
 # ─── Workspace volume resolution ──────────────────────────────────────────────
-# Default: named Docker volume (fully isolated).
-# Override: export WORKSPACE_DIR=/path/to/project before running.
+# Mounts the current working directory as /workspace inside the container.
 workspace_flag() {
-    if [[ -n "${WORKSPACE_DIR:-}" ]]; then
-        local abs
-        abs="$(realpath "${WORKSPACE_DIR}")"
-        if [[ ! -d "$abs" ]]; then
-            error "WORKSPACE_DIR does not exist: $abs"
-            exit 1
-        fi
-        echo "--volume ${abs}:/workspace:z"
-    else
-        echo "--volume ${PROJECT}-workspace:/workspace"
-    fi
+    echo "--volume $(pwd):/workspace:z"
 }
 
 # ─── Compose wrapper ──────────────────────────────────────────────────────────
@@ -164,14 +153,11 @@ Commands:
 
 Environment variables (set in .env or shell):
   ANTHROPIC_API_KEY   Required for all modes.
-  WORKSPACE_DIR       Optional (CLI mode). Host path to mount as /workspace.
-                      Defaults to a named Docker volume (fully isolated).
   WEBUI_USER          Web interface username (default: claude).
   WEBUI_PASSWORD      Required for web mode. Basic auth password.
 
 Examples:
-  ./claude.sh start
-  WORKSPACE_DIR=\$HOME/myproject ./claude.sh run
+  cd ~/myproject && ./claude.sh start
   ./claude.sh web
   ./claude.sh logs proxy
   ./claude.sh logs webui