Effect-wide staging gates need cohort isolation

A staging allowlist that authorizes an effect type is not a recipient or cohort allowlist. Before enabling it for a live canary, prove that every currently eligible action is synthetic or explicitly approved; otherwise a one-recipient test can permit other eligible effects.

This applies to any effect-wide staging gate. It does not replace application eligibility, idempotency, or human-handoff controls.