Sync Chat Pin Workspace

Pin or unpin one of the caller's own push planspaces (agent-service-facing).

Both endpoints are strictly user-scoped: a sync-chat turn can pin or write up ONLY the caller's own push planspaces. A workspace_id that is not one of the caller's own scott_push_artifacts (matched on captured_by_user_id == user_id) returns 403.

Authed by the sync-chat-turn JWT; the JWT's user_id is the only identity that matters. The request body cannot widen scope.