"""Repository layer.

All tenant-scoped reads/writes funnel through these helpers, which always filter
by ``workspace_id``. Keeping the filter here (not in route handlers) is how the
build plan enforces tenant isolation "at the data layer, not bolted on later".
"""
