Bootstrap a workspace (upload-first flows)

Transport-level replay protection — any v2 POST may send it (1–255 printable ASCII characters; UUIDs recommended). The first response for a key is recorded and replayed verbatim for retries with the same key + method/path/body for 24 hours; replayed responses carry the Idempotency-Replay: true response header. Reusing a key with a different request — or retrying while the original is still in flight — returns 409 IDEMPOTENCY_ERROR. 5xx responses are never recorded (the retry re-executes).