Add repository grant v2 publish scope and adopt daily security flow

ACTIVITY-WP-0046: grant v2 carries a publish scope (remote, branch, path
prefixes inside allowed_paths, fast-forward only) in its canonical grant id;
v1 stays local-only with unchanged ids.

ACTIVITY-WP-0047: disabled daily-security-flow definition dispatching the
the-custodian runner as an ops_run (CUST-WP-0079-T03).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 296847@bnt-lap001
Assistant-Session: 4f997d46-1b9d-4131-9699-0c353a215155

tests/test_repository_grant.py

@@ -80,3 +80,54 @@ def test_ops_run_schema_has_separate_grant_and_close_identity_columns() -> None:
 
     assert columns["repository_grant"].nullable is True
     assert columns["close_intent_digest"].nullable is True
+
+
+def _publish_grant(**scope_changes: object) -> dict:
+    scope = {
+        "remote": "origin",
+        "branch": "main",
+        "path_prefixes": ["checkpoints/"],
+        "fast_forward_only": True,
+    }
+    scope.update(scope_changes)
+    return _grant(
+        version="2",
+        allowed_paths=["checkpoints/"],
+        publish=True,
+        publish_scope=scope,
+    )
+
+
+def test_v2_grant_carries_publish_scope_in_payload_and_identity() -> None:
+    raw = _publish_grant()
+    grant = RepositoryGrant.model_validate(raw)
+    narrower = RepositoryGrant.model_validate(
+        _publish_grant(path_prefixes=["checkpoints/2026/"])
+    )
+
+    assert grant.payload() == raw
+    assert grant.grant_id != narrower.grant_id
+    assert "publish_scope" not in RepositoryGrant.model_validate(_grant()).payload()
+
+
+@pytest.mark.parametrize(
+    "value",
+    [
+        _publish_grant(fast_forward_only=False),
+        _publish_grant(remote="https://example.org/repo.git"),
+        _publish_grant(branch="refs/heads/main"),
+        _publish_grant(branch="feature/../main"),
+        _publish_grant(branch="-force"),
+        _publish_grant(path_prefixes=["docs/"]),
+        _publish_grant(path_prefixes=["checkpoints-other/"]),
+        _publish_grant(path_prefixes=[]),
+        _publish_grant(force=True),
+        {**_publish_grant(), "publish": False},
+        {**_publish_grant(), "version": "1"},
+        _grant(version="2", publish=True),
+        _grant(publish_scope=_publish_grant()["publish_scope"]),
+    ],
+)
+def test_v2_grant_rejects_unsafe_or_inconsistent_publish_scope(value: dict) -> None:
+    with pytest.raises(RepositoryGrantError):
+        validate_repository_grant(value)