test(workspace): preserve member-facing access without repositories

Apply T-717 item6/thread7 user decision: settings stay owner-controlled, ordinary non-owner viewing remains permitted under existing authentication. Add real HTTP assertions for non-owner workspace reads and absent management permissions; existing owner-only repository/deletion mutations and anonymous rejection remain exercised. Replace obsolete pending-policy documentation; no production authorization policy change.

Validation: targeted repository-free HTTP test, root cargo check, yoi-workspace-server 639 lib + 11 bin tests, canonical OpenAPI freshness, cargo fmt and baseline/HEAD diff checks pass. Rust tests/documentation only; rendered UI and previously reviewed browser/visual evidence are unchanged.

crates/workspace-server/src/server.rs

@@ -45115,6 +45115,23 @@ mod tests {
             StatusCode::OK,
         )
         .await;
+        let non_owner_workspace = request_json_authenticated(
+            app.clone(),
+            "GET",
+            &format!("{scoped}/workspace"),
+            None,
+            &foreign,
+            StatusCode::OK,
+        )
+        .await;
+        assert_eq!(
+            non_owner_workspace["permissions"]["manage_repositories"],
+            false
+        );
+        assert_eq!(
+            non_owner_workspace["permissions"]["delete_workspace"],
+            false
+        );
         request_json(
             app.clone(),
             "GET",

docs/design/workspace-optional-repository.md

@@ -47,8 +47,10 @@ a Repository, replay always returns `null`, even after other assets are added.
   Reopening and deletion use the usual Workspace authority and lifecycle guards;
   in particular, the last-accessible-Workspace deletion guard is unchanged.
 
-The existing authenticated non-owner viewing policy is unchanged by optional
+Optional creation preserves the existing owner/member responsibility split:
-creation. Owner-only mutations and owner-scoped catalog discovery are retained;
+settings are owner-controlled, while ordinary viewing and use are member-facing.
-these are not a claim that authentication alone proves per-Workspace viewing
+Non-ownership alone is not a reason to deny ordinary viewing. Existing
-permission. The T-717 viewing-policy decision remains separate from the creation
+member-facing non-owner reads, owner-gated settings mutations, owner-scoped
-contract.
+catalog discovery, authentication and operation-permission checks are unchanged.
+This creation change does not introduce a membership authority or an owner-only
+viewing filter.