Bind Existing

Attach this project to an existing workspace the caller owns.

Non-visibility is a 404, not 403 — a caller walking the integer id-space should get the same response for "no such workspace" and "someone else's workspace". Upgrade semantics: if the request supplies both a remote and a path, either one resolving to this workspace is idempotent success, either one resolving to a DIFFERENT workspace is 409, both unresolved falls through to a fresh INSERT (and a row that carries both identifiers so future lookups by either succeed).

The target Datamate is locked FOR UPDATE before the binding write (M5) so a concurrent soft_delete_datamate can't tombstone the parent between visibility check and INSERT.