Workspace runtime stats

Read-only store/ML readiness for the workspace. GET here, but POST /v1/stats upstream: stats is a native primitive and the native surface is POST-only. Response is the native OpResult envelope. Class A — accepts a session JWT, an il_live_/il_test_ API key, or an il_oauth_ token. On the il_* lanes the bearer is forwarded to Kairos verbatim and Kairos enforces the credential's grant on this workspace (its 401/403 is surfaced in the v2 envelope). The response body is Kairos's, passed through unchanged; X-InfoLang-Tokens-Saved / X-InfoLang-Overage are echoed when set.

Requires the memories:read scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying memories:read is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which INCLUDES memories:read — every key minted before scoping keeps working here.