fix(enrollment): preserve workspace enrollment authority

[jhrozek]

Summary

• Workspace enrollment replaced a session's whole tool capability set with the latest broker catalogue. That dropped unrelated authority (core, delegation, memory, skill, global/client-MCP, resource, and latent-member capabilities), and after a restart or clear/fork the server could not tell stale broker keys from capabilities the session should keep.
• This PR persists a bounded broker-key ledger with a presence bit on the Session aggregate (through sessnap and eventsource). A completed enrollment now replaces only the prior broker bundle.
• The server sets authority and ledger together on every root-creation and authority-carrying path (clear, fork, and CreateSession with a source session). session.New starts with absent provenance, so a path that forgets the ledger refuses enrollment instead of keeping stale keys.
• Excluded broker keys stay in the ledger, so an exclusion survives a refresh that omits the key.
• A broker/non-broker registration collision fails the whole enrollment with a presentation-safe FailedPrecondition naming only the key, clears the pending enrollment, and leaves prior authority and ledger unchanged. A recorded key still held in authority that a non-broker tool later takes fails every engine build for that session until the operator corrects the configuration.

Development stage

• Plan / Interface — Bounded/Architectural behavioral and exact-interface contract; no implementation
• Implementation — based on an approved, merged Plan / Interface PR
• Combined — compact one-task Bounded/Architectural exception; no separate plan PR,
  and the in-PR plan declares **Expected tasks:** 1, a non-placeholder
  **Combined rationale:**, and no runtime/public/operator/persistence/trust-boundary
  interface change (None — rationale; workflow-only meta-changes may review process
  docs/skills here)
• Spike / Routine / Cleanup — acceptance-plan spine exempt; Spike evidence does not ship as-is

Contract linkage

• Work classification: Architectural
• Classification rationale: adds durable provenance to persisted session authority and changes snapshot, successor, and enrollment-failure semantics.
• Decision record: ADR 0358 (Proposed in docs: plan workspace enrollment authority repair #1741)
• Human waiver of spine: No
• Acceptance plan: docs/acceptance/workspace-enrollment-authority.md (in docs: plan workspace enrollment authority repair #1741)
• Human decisions resolved and recorded: Yes — including the 2026-09-23 amendments in docs: plan workspace enrollment authority repair #1741
• Plan / Interface PR: docs: plan workspace enrollment authority repair #1741 (merged)
• Approved commit baseline: 3e80d41cf20c6060f4f683a3c5ba513db752cc96 (docs: plan workspace enrollment authority repair #1741 squash merge)
• Combined/exemption rationale: N/A

Interface conformance

• Matches the approved contract (3e80d41cf): the two added Session accessors, the changed CompleteWorkspaceEnrollment semantics, the sessnap.Snapshot / eventsource.SessionMeta fields, no proto/RPC/config changes. Adds the AC1.5 proof that direct MCP refresh (feat(mcp): reconcile sources and refresh session tools #1673) refuses broker-bound sessions.

Issue relationship

Relates to #1740

Type of change

• Behavioral/interface plan
• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation/process
• Other (describe):

Test plan

Baseline checks

• Acceptance-plan checker
• Linting (task lint)
• Fast offline test suite (task test)
• Pre-review race suite (task test:race)
• Offline demo (go run ./cmd/mecademo)
• Markdown changed: docs generation/link checks (task docs)
• User docs/user-facing behavior changed: site build (task site:build)
• Guarded engine API affected: compatibility check (task api:check)
• Intentional engine API change: task api:update + engine/CHANGELOG.md
• Landed plan: strict acceptance trace (task ac-trace-strict)
• Final implementation review: /panel-review

Run on this branch before the final rebases, which changed only docs (the tree is otherwise identical); CI re-runs everything:

• task lint: 0 issues in the root, engine, authn/oidc, and four provider modules (run with --timeout 20m; the default timeout was too short on a cold cache).
• task test, task api:check, task docs, task site:build, and the offline demo passed.
• Acceptance-plan checker: passed, with the pre-existing warning that the plan's test names do not use TestADR_NNNN_* / TestInvariant_*.
• task test:race (run module by module with -p 4): all seven modules passed with no data races, except three subprocess-timing tests in cmd/mecatui/agenthook that hit 10-second waits under full-suite load. That package is untouched by this PR; rerun alone with -race, it passes.
• Not run yet: task ac-trace-strict (applies once the plan is landed), and /panel-review.

Changes

Area	Change
engine/session	Ledger + presence bit; absent by default; write-once restore; completion keeps excluded keys and checks bounds before mutating
engine/adapter/sessnap, eventsource	Persist and restore the ledger; raw-JSON validation of presence, keys, and bounds
internal/adapter/server	carriedAuthority carries authority + ledger together; creation records broker registration keys; typed collision error; collision/overflow clears pending
internal/app	Broker tools register last against frozen keys; collision handoff without extra Spec() calls
cmd/mecatui/ui	Collision shown as a terminal failure; retained prompt not sent; /tools-connect retry offered

User-facing change

• /tools-connect no longer strips tools unrelated to the broker from the session.
• A broker tool name that collides with another tool now reports a setup failure naming the tool, and the session keeps accepting prompts.
• Sessions saved before this change cannot enroll; create a fresh session.

Special notes for reviewers

• A later-appearing non-broker tool that takes a recorded broker key blocks the session until the operator fixes the configuration. This trades availability for the guarantee that a durable key never resolves to a different implementation (decision recorded in docs: plan workspace enrollment authority repair #1741).
• The engine API gate: two accessors are Added; CompleteWorkspaceEnrollment's semantics are classified Changed (breaking, pre-v1 minor) in engine/CHANGELOG.md.