Revert to systemd-nspawn without manual bind mount

- Remove chroot approach
- Use systemd-nspawn -q -D directly
- workspace.nspawn config (Bind mount) will be automatically applied
- Simpler and cleaner approach

cfg/setup-user.sh

@@ -75,11 +75,7 @@ if [[ -o login ]] && [[ -o interactive ]]; then
     if [[ -z "$INSIDE_WORKSPACE" ]]; then
         # Running as ai user on aios OS - enter workspace container
         export INSIDE_WORKSPACE=1
-        # Setup bind mount for shared user directory
-        sudo mkdir -p /var/lib/machines/workspace/root 2>/dev/null || true
-        sudo mount --bind /home/ai /var/lib/machines/workspace/root 2>/dev/null || true
-        # Enter workspace via chroot (avoiding nested systemd-nspawn audit issues)
-        exec sudo chroot /var/lib/machines/workspace /bin/zsh
+        exec sudo systemd-nspawn -q -D /var/lib/machines/workspace /bin/zsh
     else
         # Running as root inside workspace container - start claude
         if command -v claude &>/dev/null; then