Delete a workspace (metadata only)

Deletes Supabase metadata only — the Kairos-side workspace, grants, and keys are not torn down.

409 not_empty while the workspace still holds memories. Because this deletes metadata and nothing else, deleting a workspace with a corpus in it would strand every memory in storage: billable, and unreachable, since every route that could remove them is addressed by a workspace id that no longer resolves. Drop each namespace first (DELETE /v2/workspaces/{id}/namespaces/{ns}), then delete the workspace. error.details.namespaces lists what is in the way. There is no force flag.

Requires the workspace:delete scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying workspace:delete is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include workspace:delete — mint a key with it explicitly (POST /v2/workspaces/{id}/keys).