Bind Existing

Attach this project to any existing workspace the caller can see.

That is the same rule as GET /datamates/: owned, tenant-wide, or restricted and granted to the caller or a team they belong to. It has to be, because the CLI's workspace picker is built from that list.

Non-visibility is a 404, not 403 — a caller walking the integer id-space should get the same response for "no such workspace" and "someone else's workspace". Upgrade semantics: if the request supplies both a remote and a path, either one resolving to this workspace is idempotent success, either one resolving to a DIFFERENT workspace is 409, both unresolved falls through to a fresh INSERT (and a row that carries both identifiers so future lookups by either succeed).

The target Datamate is locked FOR UPDATE before the binding write (M5) so a concurrent soft_delete_datamate can't tombstone the parent between visibility check and INSERT.