fix(workspaces): guard the workspace page against version skew

[posthog]

What changed

• Why: a deploy dropped a field the workspace page still read, and a stale browser tab crashed on render. The workspace page is the core surface, and it had no guard against this class of skew.
• Validate the workspace page payload against workspacePageSchema at the react-query boundary in workspacePageQueryOptions. A shape mismatch means the running bundle is stale relative to the server.
• On mismatch, reload the tab once (guarded by a sessionStorage marker) to pull the current bundle, rather than letting a downstream read crash the render.
• Unknown fields still pass: Zod strips them, so adding a field stays backward compatible; only a removed required field triggers a reload.
• After one failed reload the guard stops and the payload error reaches the existing error boundary, so a real server fault never loops.

Why the fix lives at the query boundary

• createServerFn validates request input only — it has no response validation. The server guarantees the shape at the TypeScript type level, not at runtime.
• Client-vs-server bundle skew can only be seen on the client, right before it trusts the deserialized shape. That point is the queryFn.

Scope note

• The realtime delta path (applyWorkspacePageDeltaToCache) is already Zod-guarded through parseWorkspaceRealtimeServerMessage, so it stays unchanged.
• A proactive build-id / app-version check is a broader, cross-cutting change (build-time id injection, server header, poll and reload UX). This PR ships the direct, symptom-matching guard for the observed crash class; the build-id check is a possible follow-up.

Testing notes

• pnpm check — pass.
• New unit tests in workspace-page-payload.test.ts cover: valid payload returns the page, an added unknown field still parses, a missing top-level field returns null, and an item missing a required field returns null.
• pnpm test for the workspaces feature — 291 pass.

---

Created with PostHog Desktop from this inbox report.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 90fd123.}