Get Binding For Remote

Look up whether this tenant already has a workspace linked to repo_remote.

Server-authoritative pre-check for the CLI's post-scan prompt: a 200 return says "there's a binding, render the already-linked dialog"; a 404 says "unbound, render the create/link offer". The CLI never treats its own local cache as authoritative when this endpoint is reachable.

Consensus review M1: a workspace that the caller can neither own nor see (private + not their datamate) 404s as if the remote were unbound so the endpoint does not double as a workspace-metadata oracle.