Bind auth-off observations to the local project epoch

Why: The real local-mode product has authoritative project access without an enabled account-model row.

Evidence: The app suite passes; non-local missing or disabled accounts still fail closed.

Impact: Auth-off local acceptance can record a nonempty authorization epoch while authenticated deployments retain account-version binding.

Refs: TT-N03

internal/app/project_work_observation.go

@@ -136,10 +136,16 @@ func deliverProjectWorkRows(ctx context.Context, st *store.Store, provider *exte
 			return completed, fmt.Errorf("project work source %s: current project authorization denied", row.EventID)
 		}
 		account, err := st.GetAccountByOwner(row.Owner)
-		if err != nil || !account.Enabled {
+		authorizationEpoch := ""
+		if err == nil && account.Enabled {
+			authorizationEpoch = fmt.Sprintf("account:%d:project:%s", account.AuthVersion, row.ProjectID)
+		} else if row.Owner == store.OwnerDefault {
+			// Auth-off local mode has no enabled account model. The project-work
+			// callback above is still authoritative for this process.
+			authorizationEpoch = "auth-off-local:project:" + row.ProjectID
+		} else {
 			return completed, fmt.Errorf("project work source %s: current account authorization unavailable", row.EventID)
 		}
-		authorizationEpoch := fmt.Sprintf("account:%d:project:%s", account.AuthVersion, row.ProjectID)
 		observation := extension.WorkObservation{
 			EventID: row.EventID, Phase: "source-committed", Actor: row.Owner, Owner: row.Owner,
 			ProjectID: core.ID(row.ProjectID), ConversationID: core.ID(row.ConversationID), RunID: core.ID(row.RunID),