feat(workspaces): status and list use cases

getWorkspaceStatus returns persisted { id, status } only (runner-driven
transitions arrive in story 07); listWorkspaces returns the
credential-free workspace array with a strict void input (optional on
the tRPC procedure so clients can call without args). Repository gains
listWorkspaces on interface, mock, and Payload impl; the contract suite
covers listing incl. the never-returns-credentials guarantee.
Controller span+capture wrapping is extracted into a shared
bindWorkspacesController helper used by both binders, trimming the
bind-production/bind-dev-seed clone family fallow was flagging.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK

packages/workspaces/src/application/use-cases/connect-workspace.use-case.test.ts

@@ -48,6 +48,7 @@ describe("connectWorkspaceUseCase", () => {
     const leakyRepo = {
       getWorkspace: async () => null,
       getDecryptedCredential: async () => null,
+      listWorkspaces: async () => [],
       createWorkspace: async () => ({
         id: "ws-1",
         name: "Acme Web",
@@ -101,6 +102,7 @@ describe("connectWorkspaceUseCase", () => {
     const failingRepo = {
       getWorkspace: async () => null,
       getDecryptedCredential: async () => null,
+      listWorkspaces: async () => [],
       createWorkspace: async () => {
         throw new Error("boom");
       },
@@ -123,6 +125,7 @@ describe("connectWorkspaceUseCase", () => {
     const malformedRepo = {
       getWorkspace: async () => null,
       getDecryptedCredential: async () => null,
+      listWorkspaces: async () => [],
       createWorkspace: async () => ({ id: "", name: "x" }) as never,
     };
     const useCase = connectWorkspaceUseCase(malformedRepo);