Poll a hosted gateway sign-on for its workspace key (fleet operator)

The operator's poll, with the same Entra token as the start: a device code redeems only for the operator who started it. Until the customer decides, it answers authorization_pending (or slow_down, with a 5 s wider interval, when polled sooner than the interval allows). Once approved, the next poll first applies approval's workspace rules again (the approver ADMIN or above, a paid plan, an active entitlement); a workspace that no longer qualifies denies the authorization (access_denied with a reason), and Accounts being unreachable answers 503 temporarily_unavailable to retry, nothing minted. Otherwise it mints the key in the same transaction that consumes the authorization and makes it the tenant's current key (one per organization and tenant label), and returns it exactly once: a MEMBER key named agentsafe-hosted-<tenant_label> with scopes ["decision:shadow"], created by the approver. The key expires at confirm_by (10 minutes) unless the holder calls POST /v1/hosted-gateway/keys/confirm with it, so a key whose delivery was never confirmed does not stay active. The tenant's earlier keys (replaced_key_ids) stay live until that confirmation revokes them, except one that was itself never delivered, which is revoked now; a new key that is lost in transit never leaves the tenant without one. Later polls answer invalid_grant. Sixty polls per minute per operator.