Restrict config changes to top-level workspaces

Problem/Motivation

Config changes made in a sub-workspace break on merge. WorkspaceMerger doesn't know about the module's key_value_workspace overlay rows (config entity lookup indexes, bundle field maps) nor dispatches a merge event through which the module could move them. After a merge, the parent would hold config revisions without their matching lookup and field-map data.

Proposed resolution

Allow config changes only in top-level workspaces:

• The active config storage decorator rejects write(), delete(), rename() and deleteAll() while a sub-workspace is active. An active workspace ID that cannot be loaded rejects the operation instead of allowing it.
• The form alteration marks the config forms this module manages as workspace-unsafe in a sub-workspace, so core's workspace form validation blocks submission with its standard message. This has to actively set workspace_safe to FALSE because core marks managed config entity forms safe through their ignored workspace handler.
• Reads are unchanged: sub-workspaces keep read-only inheritance of staged config.