refactor(auth): remove context grant authority

[halfofning]

Summary

• Remove context-grant fields from Agent, Workflow, schedule, webhook, token, and persistence contracts.
• Make assigned native tools the routing authority and add deterministic capability-route resolution.
• Keep ordinary Agent metadata updates from revalidating untouched runtime-managed MCP identifiers.

Cross-Repo Change Set

Tracking issue: none

Related PRs:

• refactor(auth): remove context grant authority #24
• docs(api): remove context grant fields docs-website#16
• refactor(auth): remove context grant claims llm-gateway#7
• feat(ui): harden workflow workspace experience management-console#26

Merge order:

1. control-plane
2. docs-website
3. llm-gateway
4. management-console

Validation

• Full test run: 1,097/1,098 passed; the sole failure used the pre-fix Agent-conversation readiness mock.
• Focused Agent-conversation suite after the mock fix: 4/4 passed.
• Style, migrations, authorization, membership, run-event durability, contracts, OpenAPI, and harness checks passed.
• TypeScript typecheck passed; a clean emit to /tmp passed. The repository dist directory contains permission-mismatched generated files, so the in-place emit could not overwrite them.
• Workspace platform-contract validation could not start because test/fixtures/workflow-template-conformance.json is absent from the local control-plane checkout.

Docs Impact

• Updates contract manifests, security guidance, external-integration documentation, and completed execution plans.

Residual Risk

• This removes unreleased cross-service fields and must be coordinated with the gateway, console, and documentation PRs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1d300b8a9f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove obsolete grants from the webhook description

After this schema removes approvedContextGrants and rejects additional properties, the generated OpenAPI operation description at line 104 still says webhook updates can change “approved grants.” Clients following that description will send a field that both the schema and controller reject, so update the operation text to advertise only the remaining mutable fields.

Useful? React with 👍 / 👎.