Scope staging-only public mutation flags to one capability

If a staging-only unauthenticated escape hatch is explicitly required, model it as a separate narrow capability instead of passing a general privileged flag and masking permissions afterward. Gate it on explicit opt-in and the exact staging environment.

Keep every unrelated mutation on the normal authorization path. Test production, preview, unknown environments, and future capabilities fail-closed. This pattern reduces privilege spillover; it does not make the exposed staging capability safe without its own abuse and data controls.