`POST`, `PATCH` (`name` immutable), and `DELETE` on `/api/v1/:slug/repositories`, restricted to `kind=hosted`. Enforces repository name global uniqueness within the slug and immutability (ADR-009). Remote and virtual repository creation is out of scope, gated on S13. Follows the merged Phase 1 plan.