feat(aigateway): workspace create/update/delete with confirm guards

[cdot65]

Summary

Slice 3 of #299: AI Gateway workspace writes. Stacked on #306 — merge that first.

Changes

• SdkAiGatewayService.createWorkspace/updateWorkspace/deleteWorkspace — camel→snake mapping; create/update re-read via admin-plane get (create returns a partial record, update returns {}); delete performs no verify-get (archived workspaces 404 by design)
• airs aigateway workspace create — --name + --scope-name required; warns when scope shares no token with name (the "workspace went missing" foot-gun); JSON flags for defaults/metadata/limits (limits are ARRAYS)
• airs aigateway workspace update <ref> — true partial patch, at least one field required (exit 2 otherwise)
• airs aigateway workspace delete <ref> — reported as archived (no hard delete exists), confirm prompt with --force bypass, rm alias
• Docs: write sections in docs-site/docs/cli/aigateway/workspaces.md; changeset (minor)

Testing

• TDD: failing wrapper + helper specs committed first
• 906 tests green (14 new); tsc + Biome + docs build clean

Closes #302