fix: persist workspace Python environments

docs/operations.md

@@ -47,6 +47,12 @@ Compose file, image, repository, or log.
 The SSH override removes `/var/run/docker.sock` from Gateway and mounts the
 dedicated SSH directory read-only at `/root/.ssh`.
 
+The Workspace image keeps the user home, package caches, and Python user base
+under `/workspace/.agent`; the conventional project virtual environment is
+`/workspace/.venv`. Updating `WORKSPACE_IMAGE` to a new immutable tag causes
+Gateway to replace each stale workspace container on its next access while
+retaining the user's named data volume.
+
 ## Ollama model residency
 
 The NAS Ollama service keeps Luna, Terra, and Sol resident with: