Full per-tree isolation (with respect to supporting resources such as downloads) + other refinements to workspace-manager script