feat(workspace): allow creation without an initial repository

Keep bootstrap, signing identity, config and resource-key allocation atomic with optional Repository intent. Preserve repository-present fingerprints for saved receipts; replay reads current authority at the initial key and never recreates missing assets.

Provide explicit repository-free CLI creation, optional TUI/Web creation inputs, nullable generated contracts, and valid empty catalog/Worker paths. Retain existing authenticated non-owner viewing policy pending the T-717 authorization decision.

Validation: root cargo check; server tests 639 lib + 11 bin; server-api 70 default / 77 typescript; client 52 lib + 2 integration; tui 337; yoi 11 lib + 120 bin. OpenAPI/TS freshness, cargo fmt and diff checks pass. Web check/build, 18 model tests, 268 component tests and Chromium 8 width/theme combinations pass; before/after visual evidence is documented in web/workspace/test/visual-review. Full Web suite has one independently reproduced baseline Ticket source-policy failure.

openapi/server-api.json

@@ -13963,7 +13963,7 @@
       },
       "WorkspaceCreateRequest": {
         "additionalProperties": false,
-        "description": "Request for atomically creating a Workspace and its initial Repository.",
+        "description": "Request for atomically creating a Workspace with an optional initial Repository.",
         "properties": {
           "display_name": {
             "type": "string"
@@ -13972,19 +13972,25 @@
             "type": "string"
           },
           "repository": {
-            "$ref": "#/components/schemas/InitialRepositoryIntent"
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/InitialRepositoryIntent"
+              },
+              {
+                "type": "null"
+              }
+            ]
           }
         },
         "required": [
           "operation_key",
-          "display_name",
-          "repository"
+          "display_name"
         ],
         "type": "object"
       },
       "WorkspaceCreateResponse": {
         "additionalProperties": false,
-        "description": "Response returned after atomically creating a Workspace and its first Repository.",
+        "description": "Response returned after atomically creating a Workspace.\n\nOn replay, Workspace/config and the Repository at the originally requested key are\ncurrent authority, not historical snapshots. Repository is null when creation omitted\nit or that key has since been removed/renamed; replay never recreates an asset.",
         "properties": {
           "config_revision": {
             "format": "uint64",
@@ -13996,7 +14002,14 @@
             "type": "boolean"
           },
           "repository": {
-            "$ref": "#/components/schemas/WorkspaceRepositoryRecord"
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/WorkspaceRepositoryRecord"
+              },
+              {
+                "type": "null"
+              }
+            ]
           },
           "request_fingerprint": {
             "type": "string"
@@ -14007,7 +14020,6 @@
         },
         "required": [
           "workspace",
-          "repository",
           "config_revision",
           "request_fingerprint",
           "replayed"
@@ -15538,7 +15550,7 @@
   "info": {
     "title": "Yoi Server API",
     "version": "0.1.0",
-    "x-yoi-source-digest": "sha256:4f468e00efa86e6e33e8fa4f14deca93ee15b955071920facd56c59c3d2fefb8"
+    "x-yoi-source-digest": "sha256:fcd997d5ab44e2197ce674fd4ffd59eb84355e161c0a7f500190bdc991c9f053"
   },
   "openapi": "3.1.0",
   "paths": {