You manage a Fabric workspace for a data engineering team. A new colleague needs to create and edit lakehouses, run pipelines, and update semantic models, but must NOT be able to add or remove other users from the workspace or change workspace-level access permissions. Which workspace role should you assign to grant exactly these capabilities with the least privilege?