Rename a workspace the authenticated user administers.

Requires ADMIN role in the workspace (the write service decides). Workspace membership is the tenancy here, so a workspace outside the caller's memberships is a 403 rather than a 404, as on the project create; a name the caller already administers a workspace under is a 409.

Args: request (Request): Incoming request (rate-limit plumbing). response (Response): Outgoing response (rate-limit plumbing). auth (AccountStampedAuth): Account-scope user auth (session token or CLI access JWT); its resolved user_id becomes the actor. workspace_id (str): The workspace to edit. payload (UpdateWorkspaceRequest): The fields to change. _live (None): Write-path liveness gate (blocks a revoked JWT session).

Returns: UpdateWorkspaceResponse: The updated workspace and the changed fields.

Raises: HTTPException: The write service's 400/403/404/409 verbatim, or a 503 when its response is ambiguous.