fix(v2): hold create to the rules update enforces, and bind the last two cursors (#6684)

Three defects, one shape: a rule applied to one path and not its sibling.
Two were found by probing the live surface after the previous fixes
deployed, and the third by reading for the pattern.

Creating a workflow group through the public surface validated almost
nothing the update path validates. An enrichment group could name an
enrichment the registry does not define, or an output the enrichment does
not have, or carry no output id at all — each a 201 storing a column no
run can ever write, discovered only when the caller later tried to edit
the group and got the 400 create should have given. The workflow half was
the same: a fabricated block-and-path coordinate was stored on create and
refused on update. Create now runs the same two registry helpers and the
same workflow-output check the update path uses.

The discriminator there is the backing workflow id, not the declared
type. The workflow sidebar creates enrichment-template groups labelled
`enrichment` while backed by a real workflow and carrying no enrichment
id, so keying on the label would have refused the first-party create
path outright.

A group's producer type could also be relabelled after the fact into a
state creation refuses. Nothing rejected it and nothing could repair it,
since the update body carries no enrichment id to supply. Relabelling an
enrichment group as workflow-backed is the harmful direction: it keeps
the enrichment id while moving the group onto the workflow branch with an
empty workflow id, so every cell run fails. An update may now only
restate the type the group already has.

The workflow-version and workspace-member lists were the last two paged
reads minting cursors with no route identity, so a token from one parent
resumed another at a position that silently skips rows — the defect the
previous change closed everywhere else. Both now wrap their domain token
with the same scope binding, and the pagination guardrail gained a
declaration of every nested list's parent path param, because the old
one recorded only query filters and so could not tell an unfiltered list
from a forgotten parent.

apps/docs/openapi-v2-tables.json

@@ -6806,7 +6806,7 @@
             "enum": ["live", "deployed"]
           },
           "type": {
-            "description": "Replacement workflow-group producer type.",
+            "description": "Workflow-group producer type. Must match the group's stored type — a group's producer cannot be changed after creation.",
             "type": "string",
             "enum": ["manual", "enrichment"]
           },