feat: add shared ai workspace assistant service

services/ai-workspace-assistant/README.md

@@ -0,0 +1,64 @@
+# NODE.DC AI Workspace Assistant
+
+Platform-owned shared state service for the cross-surface AI Workspace assistant.
+
+It owns:
+
+- user AI Workspace executors/devices and selected executor;
+- assistant conversation/thread metadata;
+- surface context and enabled tool packs;
+- linked artifacts between Engine, Ops and future platform surfaces.
+
+It does not replace the AI Workspace Hub. The Hub remains the thin transport/rendezvous layer for remote Codex workers.
+
+It does not replace the legacy Ops MCP config flow:
+
+```text
+external Codex client -> ~/.codex/config.toml -> nodedc-ops-agent MCP -> Ops Agent Gateway
+```
+
+That flow remains a separate product path.
+
+## API
+
+All endpoints require the shared internal token. App BFFs pass the resolved platform subject through:
+
+```text
+X-NODEDC-User-Id
+X-NODEDC-User-Email
+```
+
+Executor registry:
+
+```text
+GET    /api/ai-workspace/assistant/v1/executors
+POST   /api/ai-workspace/assistant/v1/executors
+PATCH  /api/ai-workspace/assistant/v1/executors/:executorId
+DELETE /api/ai-workspace/assistant/v1/executors/:executorId
+POST   /api/ai-workspace/assistant/v1/executors/:executorId/select
+```
+
+Conversations:
+
+```text
+GET   /api/ai-workspace/assistant/v1/threads
+POST  /api/ai-workspace/assistant/v1/threads
+GET   /api/ai-workspace/assistant/v1/threads/:threadId
+PATCH /api/ai-workspace/assistant/v1/threads/:threadId
+POST  /api/ai-workspace/assistant/v1/threads/:threadId/messages
+GET   /api/ai-workspace/assistant/v1/threads/:threadId/messages
+```
+
+Supported initial surfaces:
+
+- `engine`
+- `ops`
+- `global`
+
+Supported initial tool packs:
+
+- `engine`
+- `ops`
+- `ndc-agent-core`
+- `deploy`
+- `docs`