Capture authorized realtime routing custody or a domain page

Upcoming, not deployed. Omitted scope captures ordinary Workspace routing custody. The account, account_security, inbox and personal_projects scopes accept only the scope query parameter and return content-free routing custody. The discuss scope returns private conversation sequence custody without message content or an atomic transcript snapshot. They do not establish an atomic domain snapshot. Account scopes work without a Workspace. All private cursors bind the current User and browser session or native access-token identity; Workspace-private cursors also bind current membership. Native mobile callers use a single bearer with no Origin or Cookie, and select a Workspace with X-Assign-Workspace-ID when the scope requires one. Projects and task_comments return a canonical page and its same-snapshot cursor. task_comments requires a canonical UUID resource_id and admits at most two items. Canonical private reads use X-Assign-Realtime-Baseline instead. IDE developer bearers (assign-jetbrains or assign-vscode) admit only omitted scope/workspace custody, projects and task_comments. Their grant fixes the Workspace; an optional Workspace header must match. They omit Origin and Cookie. Private Account and Discuss baselines are denied. Unknown or duplicate query parameters are rejected.