Create the organization of a Microsoft platform purchase (internal producers)

Internal; default off (503 platform_workspaces_disabled until DECIONIS_PLATFORM_WORKSPACES_ENABLED is 1). Only a producer whose token (DECIONIS_DELIVERY_PRODUCERS_JSON) carries platforms: ["microsoft"] may call it: no token or an unknown one is 401 producer_required, any other producer 403 platform_not_allowed, and an organization key is never accepted. Commerce passes the workspace mapping Accounts signed for a decionis-platform purchase, with its evidence, verbatim. Core checks the version, platform, product and environment (400 otherwise); that the Accounts organization and workspace ids derive from source_org_id, that issued_at is within the last 10 minutes, and the Ed25519 signature over the canonical (sorted-key) mapping against the current Accounts JWKS (422 accounts_evidence_invalid with reason ids, stale or signature; 503 accounts_evidence_unavailable while the JWKS is unreachable). In one transaction it creates the organization with id = source_org_id, no Core owner, source product decionis and the production environment, its default entitlement, and the synchronized Accounts workspace reference, so the buyer's later Decionis sign-in to that workspace lands in this organization. The same reference again is 200 replayed; an existing organization with any other reference, a workspace already bound elsewhere, or an organization created for another subscription is 409 organization_conflict. No person, session or key is created. The optional subscription is the subscription's current state from Commerce's lifecycle, outside the signature: its paid plan becomes the organization's entitlement in the same transaction (422 plan_unknown for a plan code Core does not sell, before any write), and the answer reports what it did as subscription. Without it the organization gets the default entitlement.