Resolve regimes by id (NOT an enumeration)

Resolves the ids in ?ids=a,b plus every regime named by a live conflict. It is deliberately not a listing: the regime verb surface has no enumeration read — regime_status takes ONE id and no verb projects the fold's full regime list — so a complete listing cannot be served without inventing a second source of truth for identity the algebra says is exact. enumeration.complete is false on every response until an upstream verb exists.

Requires the coord:read scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying coord:read is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include coord:read — mint a key with it explicitly (POST /v2/workspaces/{id}/keys).