resolveWorkspaceConfig Object.hasOwn prototype names

Trap: workspaces[workspaceName] plus a truthiness check looks sufficient for a z.record config, but inherited names such as constructor, toString, and __proto__ resolve from Object.prototype and can silently select the base release config. Fix: reject unless Object.hasOwn(workspaces, workspaceName) before indexing; this preserves explicitly configured own keys. Regression-test all three inherited names as unknown workspaces.