fix(auth): require document-wide grants for operation writes

[marcus-pousette]

Problem

Authorizing a write from the receiver's current tree ancestry is delivery-order dependent. One peer can accept an operation while its node appears inside a scope, then replay an earlier move that puts it outside; another peer receiving the move first rejects the same operation.

That can create both an authorization bypass and permanent op-set divergence.

What changes

• Insert, move, payload, delete, and tombstone operations require a document-wide grant: ROOT with no maxDepth or exclusions.
• An ancestry-scoped write is denied immediately instead of entering pending_context.
• Stateful scope evaluation remains available for read authorization in this PR.
• Custom auth implementations with a stable causal witness may still implement their own pending-context policy.
• Obsolete scoped-write conformance and playground scenarios are removed.

Deployments that previously issued scoped write tokens need a coordinated migration because upgraded peers reject those writes.

Fast paths

• Document-wide writes take a state-independent check and do not query materialized ancestry.
• Read scope evaluation is unchanged here.
• The normal unauthenticated/custom-auth paths are unaffected.

Tests

• every operation kind requires a document-wide write grant
• current ancestry cannot make a scoped write valid
• scoped writes fail closed rather than becoming pending
• document-wide grants retain normal behavior

The large negative diff is deliberate debloating: unsupported scoped-write tests and demo flows are removed rather than replaced with more machinery.

Stack

Stacked on #157.