Set a member's complete workspace role list (full replacement). Any roles not included in the request are revoked. Use this to remove specific roles: fetch current roles via search_workspace_members, omit the role(s) to remove, and pass the remaining roles. Pass an empty role list to strip all roles while keeping the member in the workspace.

Use when: Use when an admin wants to remove one or more roles from a member, or replace the member's entire role set. ALWAYS call search_workspace_members first to get the member's current roles, then pass the new complete list without the removed role(s). To add roles without removing existing ones, use add_role instead.

Behavior: destructive

workspace_id / user_id are injected from request headers.