Add repository grant v2 publish scope and adopt daily security flow

ACTIVITY-WP-0046: grant v2 carries a publish scope (remote, branch, path
prefixes inside allowed_paths, fast-forward only) in its canonical grant id;
v1 stays local-only with unchanged ids.

ACTIVITY-WP-0047: disabled daily-security-flow definition dispatching the
the-custodian runner as an ops_run (CUST-WP-0079-T03).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 296847@bnt-lap001
Assistant-Session: 4f997d46-1b9d-4131-9699-0c353a215155

activity-definitions/daily-security-flow.md

@@ -0,0 +1,57 @@
+---
+id: daily-security-flow
+name: Daily Security Flow
+enabled: false
+owner: activity-core
+governance: custodian
+status: proposed
+trigger:
+  type: cron
+  cron_expression: "30 7 * * *"
+  timezone: Europe/Berlin
+  misfire_policy: skip
+---
+
+# Daily Security Flow
+
+Adopted from the-custodian CUST-WP-0079-T03, tracked in ACTIVITY-WP-0047.
+Activity Core owns the schedule; the-custodian owns the runner
+(`scripts/security_flow_daily.py`), its report and its delivery checkpoints.
+
+Each fire emits one ops_run for a rein on the workstation profile, which runs a
+fixed command in the-custodian checkout:
+
+```text
+python3 scripts/security_flow_daily.py --apply
+```
+
+The runner resolves hub decisions already recorded as resolved in repo decision
+logs (the sanctioned `POST /decisions/{id}/resolve`), writes a deterministic
+JSON report, and messages coding agents only when READY/UNBLOCKED change and the
+founder only when ATTENDED is nonempty. Its per-recipient checkpoint and run
+lock make a repeated or overlapping fire safe.
+
+- Daily 07:30 Europe/Berlin; misfires are skipped, never replayed.
+- No repository grant: the run reads repo files and changes nothing in any
+  repository. A rein must not commit or push for this run.
+- Activity Core does not run the script itself (out of scope: general
+  execution); it dispatches and records the ops_run outcome.
+
+**Not yet enabled.** Activation (ACTIVITY-WP-0047-T02) flips `enabled: true`
+once the claiming rein confirms it can run the command against workstation
+checkouts. Rollback: `enabled: false`.
+
+```rule
+id: run-daily-security-flow
+condition: "True"
+action:
+  task_template: Run the daily security flow
+  description: 'In the-custodian checkout run exactly: python3 scripts/security_flow_daily.py --apply. Report its exit code and the printed JSON report. Do not edit, commit or push any repository and do not send messages yourself; the script handles delivery.'
+  target_repo: the-custodian
+  priority: medium
+  labels: ["automated", "security-flow"]
+  harness_profile_ref: harness.agent-dev-local@1.1.1
+  execution_refs:
+    correlation_id: CUST-WP-0079-T03
+    assignment_ref: ACTIVITY-WP-0047-T01
+```