[Sev7eNup]

What & why

Read-only workflows still allowed annotation changes that marked the draft dirty and triggered a rejected autosave. Note and group editing now follow the edit lock, while group collapse stays available as a local viewing choice. Save and publish also check current write access before sending queued work.

Folder and workflow lists now share permission data within each request instead of querying grants for every folder. Access rules, inheritance, authority-scoped group matching and cache invalidation are preserved. In the controller test with 100 visible folders, database reads fall from 105 to 5.

Fixes #584.
Fixes #576.

How

• Keep read-only group collapse out of the authored workflow graph, including after acquiring the edit lock.
• Reuse a per-principal grant lookup and a per-request folder index for visibility and capabilities.
• Strengthen seven CLI request tests and replace telemetry construction smoke tests with actual loopback HTTP/gRPC export checks.
• Record the behavior and test improvements under Unreleased in CHANGELOG.md.

Testing

• CLI: 121 tests across the three affected API-client test classes.
• API: 184 targeted RBAC, grants, membership freshness, folder mutation and hub tests; 7 telemetry tests.
• Frontend: 176 tests in WorkflowEditorPage, useWorkflowPersistence and useDisplayedGraph.
• Frontend TypeScript build and ESLint for all changed UI files.
• Isolated mutation checks: all seven missing-request mutants and all three missing-export mutants fail as expected.
• New regression tests reproduce the prior failures and verify writable behavior, lock transitions, principal isolation and invalidation.
• git diff --check.

The query-count comparison uses SQLite in memory; its timings are not a production benchmark. Full suites, coverage and E2E run in CI. No API/schema changes, new dependencies or UI strings.