Start checkout for a workspace

Returns a Stripe Checkout URL.

The billing subject is always the workspace's OWNER, on every lane. A plan belongs to the billing ACCOUNT (profiles.plan) and quota pools there, so a subscription bought against any other principal would pay for an entitlement no workspace receives. Nothing workspace-shaped is sent to Stripe.

Consequently a session-lane caller who is NOT the owner is refused 403 even with billing:write: the owner holds the subscription and the payment method. il_* lanes have no principal to compare and act for the owner.

Requires the billing:write scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying billing:write is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include billing:write — mint a key with it explicitly (POST /v2/workspaces/{id}/keys).