Start an agent-initiated repository connection. Returns a short user code for a person to approve in the browser and a device secret the agent uses to collect the approval.

No credential is required and no repository name or spec content is sent. A person opens verificationUrl, signs in, checks that the page shows the same userCode, chooses the workspace and Product, and approves. The request expires after 15 minutes. The device secret is returned once and stored only as a hash; keep it on the requesting machine. A caller may send an existing pm_live_ Bearer key: it is recorded for reuse, and reused only if it belongs to the approving person and the workspace they choose. An invalid key does not fail the start. Responses set Cache-Control: no-store.