List the organizations (workspaces) the authenticated principal belongs to.

Authentication accepts an rsk API key, a requester-registration-bound OAuth agent token, a WorkOS user token, or a browser session. REG-10 is conditional: a bound registration with a public key requires all three X-Rensei-Request-* headers; a light registration without a key, an unbound rsk key, a user token, and a session do not. A strict registration without a key is misconfigured and returns 403. The public key is canonical standard base64 of the raw 32-byte Ed25519 key. The signature is canonical standard base64 of 64 bytes over the exact UTF-8 canonical-envelope JSON. Nonce replay rejection is best-effort: if Redis is unavailable, replay-cache checks fail open while signature and inclusive +/-300-second timestamp validation remain enforced. Typed requests evaluate only the current immutable configured HarnessConnection revision, an explicit live project grant, and current immutable production-promoted probe evidence; host inventory is never admission authority. A typed request that satisfies declared compatibility AND live inventory allocates a durable ledger session and returns an admitted response; anything short of that still returns a denial receipt. Spawn remains gated: an admitted node stays queued until an applied-adaptation receipt exists.