fix(server): retain current access through PR read effects

[alimek]

Summary

Delayed PR reads could use another request’s context or touch credentials and provider caches after current access changed. External GitHub entries now keep their own context; collection documents retain every participant through the final adapter check. Existing admission checks also cover credential, identity and provider-cache waits. Typed denial escapes all five providers without optional recovery or another protected fallback, including the workflow REST mapper used by production detail and checks reads.

canonical preflight → final current SQL participants → credential/cache/API effect

Evidence

• 38 real-SQL/Deferred adapter tests and211 PR service controls passed on the prior candidate; coordinator independently verified249/249 there. Provider and ordinary recovery controls passed, including write-only Git, conditional-operate preparation and owner fast path.
• Removing the final participant guard reproduced two hidden effects during A’s last canonical await; restored guard blocks both before the effect.
• Repair:25 affected workflow/denial controls pass, including six tests through the actual PR API mapper and production detail/checks provider. Three denial cases failed before repair; ordinary403 wrapping/unavailable behavior remains.
• Named server typecheck passed on the behavior repair. Namespace-only follow-up changes two test lines; six workflow REST controls and touched test lint/format/diff pass, with production behavior unchanged.

Merge Danger

Door: two-way. Blast Radius: server.

04c3b1 only; exact independent re-review pending, no source acceptance claimed. Persisted PR storage and service-held cache continuations after Clock awaits remain04c3b2; all eleven final PR write effects remain04c4. ResourceGrantGuard stays CLOSED. Whole04c3b/04c3 remain incomplete until both read-effect parts pass exact-source review.

Refs #5, #1.

[alimek]

Consolidated into #30 at the same accepted final source tree (b66e06e), now targeting feature/connection-resource-access. Closing this individual stack PR as superseded; its commits, review record and branch remain preserved. No feature activation or main/upstream merge. Tracking issues remain open until integration verification.