Workspace-flavor API keys with the
read_workspace scope reach this surface so operator dashboards
can audit webhook subscriptions without a dashboard session.
Returns workspace-wide subscriptions (agentId IS NULL +
agentFilter IS NULL), filtered subscriptions (agentId IS NULL +
agentFilter NON-NULL), and single-agent subscriptions (agentId
IS NOT NULL) belonging to this workspace.