Scope staging-only public mutation flags to one capability
If a staging-only unauthenticated escape hatch is explicitly required, model it as a separate narrow capability instead of passing a general privileged flag and masking permissions afterward. Gate it on explicit opt-in and the exact staging environment. Keep every unrelated muta…