Creates the tenant boundary for sources, scoped keys, Qdrant payload filters, and audit.
Workspace ID is written into every Postgres row, every Qdrant payload, every scoped key, and every audit event.