Follow-up to #631 (shipped in #641). Two per-workspace key-policy interactions with the `gh/private//…` shape:
- `allowedKeyPrefixes` narrower than `gh/` (e.g. `gh/owner/`) hard-400s private-mode uploads — the one place in the feature that is not fail-open
- private ingest keys are 6 segments where plain ingest was 4, so `maxKeyDepth` 4–5 newly fails ingestion
Decide whether the resolve service should consult the workspace's key policy and degrade to plain when the private shape would be rejected (keeps uploads working, loses the privacy win, should log), or whether policy docs should just call out the requirement.
Follow-up to #631 (shipped in #641). Two per-workspace key-policy interactions with the `gh/private//…` shape:
Decide whether the resolve service should consult the workspace's key policy and degrade to plain when the private shape would be rejected (keeps uploads working, loses the privacy win, should log), or whether policy docs should just call out the requirement.