Workspaces backfill and its undo (Greentally staff only)

Requires the platform capability workspace.ops; a customer organization role never grants it (403 PLATFORM_CAPABILITY_REQUIRED). 404 while workspaces are off.

mode "apply" (the default), per business organization in its own transaction: creates the default "All data" workspace unless one exists, stamps every NULL workspace_id of the workspace-owned artifacts with it, and writes a default-workspace grant for every member. Idempotent. mode "undo" reverses exactly one real apply run (runId), skipping an organization whose default was modified since. dryRun runs the same statements and rolls them back, so its counts are the real ones. Every call is recorded in the platform audit trail. Organizations are taken in id order, at most limit per call. Without organizationIds a call takes the organizations still pending (apply: no default row yet and no active workspace named "All data"; undo: not yet undone for runId), so repeat the call until it returns no items. organizationIds names organizations explicitly, whatever their state.