Save a layered workspace as the next version of an organization template

Everything in the workspace becomes template content (its whole filesystem, minus the sf-scrub.v1 list, the contents of /proc, /sys, /dev, /run and /tmp, and shared-volume contents), stored as one new org layer on the workspace’s template chain. A running workspace is captured briefly (operation, layer_snapshot); a suspended one uses its current checkpoint; checkpoint_id saves a committed checkpoint instead. 202 SaveAsTemplateResponse: poll the build. Owners/admins and API keys with a tool permission (403 otherwise). Immutable paths: the new version declares the target template’s open version’s immutable paths (else the workspace’s version’s); their content comes from that template’s newest published version, not from the workspace (a draft publish keeps the draft’s own content). Errors: 409 legacy_disk_layout, workspace_not_running, operation_in_progress, not_supported_for_mode (file-first), template_archived, 422 platform_template_slug, invalid_defaults, too_many_acknowledged_findings, invalid_path, immutable_paths_unsupported_base (the workspace’s base has no guest agent with immutable_paths.v1; details.base), 429 rate_limited (template_build_queue_full: already 10 builds queued past the plan’s concurrent_template_builds; retryable, Retry-After; a build past the plan’s slots is accepted and waits, its queue gives the position and expected wait). Supports Idempotency-Key.