Complete a repository-adoption session by binding the canonical intent that the CLI pushed.

Authentication is intentionally stricter than a normal workspace write: the API-key row id must exactly match the credential bound during exchange. Cookie sessions are rejected. Repeating completion for an already-adopted session is idempotent. On success the server emits onboarding_repo_spec_landed and the waiting browser observes the authoritative session row.