Re-evaluate access controls when read-only workflows start writing

A control safely deferred during a read-only phase becomes a prerequisite when the workflow starts persisting sensitive manifests, paths, approvals, targets, or mutation state. Before that transition, verify live row policies and grants, harden server-only access first when broad roles can reach the ledger, separate rewrite and deletion commands and approvals, and revalidate identity and current references immediately before mutation.