fix(server): guard existing workspace git mutations

[alimek]

Summary

Git writes previously lacked current resource admission at the shared service and final effect boundaries. Require current source-control:write for existing workspace mutations, init, publish and stacked actions. Keep the original registered owner/cwd through callbacks and serialized PR-link commit/replay.

current caller + actual registered workspace
  existing preflight / semaphore / thread lock
    current owner, root, grant and action check
      Git spawn / hosting request
        checked status, identity and PR refresh
        exact thread.pull-request.link receipt + SQL commit

Write-only callers stay write-only. Read-triggered optional auto-pull/fetch skips when write scope is absent. Typed authorization denial survives ordinary best-effort fallbacks.

Evidence

• Before: source audit found unguarded write entries, final spawn/request effects and trusted external PR-link callbacks.
  After: real SQL A/B roots, threads and registered worktrees; Deferred grant/scope/root/membership cuts before native Git, init, hosting HTTP and serialized link commit; hidden routing and returned-root denial; write-only and trusted controls.
• Focused server selection: 31 files, 800 passing cases in the combined run; its one timeout corrected with a local fixture and verified in a green 217-case group. Final changed cache/admission group: 177 pass; new native/link group: 18 pass; core: 136 pass; final prepare-channel group: 20 pass. Groups overlap. Named vp run --filter t3 typecheck, touched lint/format and git diff --check pass.
• One existing mode-only review diff case fails identically on exact parent 8bc05464ff263abf49a904b67b5049b4487979ba; excluded from the green core run. Old cross-repository fixture now uses the existing local remote rewrite helper.

Coordinator review repairs (same PR/base): raw Bitbucket request and same-origin redirects now retain domain authorization denial; shared Git resolve/detect mappers do likewise. Three new recovery paths use documented whole-channel Effect.catch with explicit denial passthrough. Ordinary transport/routing failures and fetch fallback stay intact.

Before repair: 3 suites, 79 pass / 4 expected regression failures (createRef, renameBranch, raw request, redirect). Denied native spawn count 0; denied initial HTTP count 0 / denied redirect hop adds no HTTP request. After: 6 focused affected write/link, Bitbucket/GitHub, accepted workspace-read and launch suites / 143 pass. Final Bitbucket run after test-only type normalization: 35 pass. Named server typecheck, 7 touched files lint/format and diff checks pass. Known parent mode-only failure remains unchanged; no broad rerun.

Merge Danger

Door: Two-way. No storage migration or activation change. Production ResourceGrantGuard remains closed through ticket 14.

Blast Radius: Server. Error channels carry typed denial through shared Git/hosting adapters; internal bootstrap/background/MCP callers retain explicit trust.

Worktree creation/removal/prune/prepare/setup/cancel remains 04c2b. Full PRService entry/routing/credential/cache protection remains 04c3; final PR writes remain 04c4. Background revocation 08, MCP 09, helper/provider/model execution 07, automation 10, raw lookup/clone/assets 05/06 and clients 11–13 remain deferred.

Source head 34141ece213f3176eae6060224c9427377964b47, exact base 8bc05464ff263abf49a904b67b5049b4487979ba.

Refs #5, #1

[alimek]

Consolidated into #30 at the same accepted final source tree (b66e06e), now targeting feature/connection-resource-access. Closing this individual stack PR as superseded; its commits, review record and branch remain preserved. No feature activation or main/upstream merge. Tracking issues remain open until integration verification.