Vend a short-TTL token confined to this one workspace (create-or-get; shown once) [org admin or manager token]

Vend a short-lived token scoped to exactly one workspace (docs/designs/workspace-tenancy.md: the per-tenant credential). Creates the workspace if the slug is new (create-or-get; cap_usd applies only then - state a budget when each workspace is a tenant or an experiment). The vended token is a gmnt_ bearer for both doors carrying infra scope in that one workspace, expiring after ttl_hours (default 4, max 168); it can never manage workspaces, vend, see the rest of the org, or list/reference org secrets, so vending only NARROWS reach - the token is strictly weaker than the credential you hold - hand it to the session that should be confined there (e.g. one end user's agent). Shown once, not listed on /team; expired rows are swept. Org admins, or a manager service token.