List namespaces

Kairos's native namespace listing (list resource=namespaces) — names only, no memory text, so it does not bill egress. Always includes default, which the native manifest scan omits for a workspace with no memories yet. Class A — all three lanes.

FILTERED to the credential's scoped_namespaces: a namespace-scoped credential sees only the namespaces it may reach. Listing the others would disclose their names, which is information customers put organizational structure into.

Requires the memories:read scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying memories:read is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which INCLUDES memories:read — every key minted before scoping keeps working here.