Identity echo for any credential

Workspace-independent answer to "what credential am I holding and what can it touch" (an STS GetCallerIdentity analog). Accepts all three lanes and has no side effects.

On the key/oauth lanes the identity comes from Kairos's workspace-independent whoami op, so principal is the credential's real Kairos principal and workspaces lists every workspace it may act in — including for a credential holding grants on more than one (previously that case returned an empty list). principal may still be null on a Kairos deployment that predates the op, where the gateway falls back to a grant-list lookup that carries no principal id.

credential.prefix is the il_<env>_<key_id> head of an API key — never secret material, and omitted for the platform-opaque key form, which has no key-id boundary to cut on.

A credential holding no grants at all is a valid identity and reports an empty workspaces list rather than failing.

scoped_namespaces is the credential's NAMESPACE ceiling — the resource axis below workspace. null means unrestricted, which is what every credential minted before namespace scoping reports. A NON-null value changes two things: a request that names no namespace is resolved rather than defaulted (with exactly one entry the gateway injects it; with two or more the request is refused and must name one), and the credential is DENIED on the /v1/* and /mcp passthrough, which cannot enforce a namespace ceiling.