feat(server): allow weighted cross-workflow reads after a view check

Exact out-of-workflow documents can be summarized when WORKFLOW_SCOPE_MODE=weighted and the caller can still view the active instance; writes stay blocked.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/workflowscope/score.go

@@ -156,6 +156,21 @@ func bestOf(candidates []Candidate, active string, scoreOf func(Candidate) float
 	return Decision{Kind: kind, Winner: best, Score: bestScore}
 }
 
+// BlocksWrite 报告一个已确定归属的任务键在写路径上是否应拦截。
+// 归属未知或未激活时不拦截。
+func BlocksWrite(active, owner, id string) bool {
+	if strings.TrimSpace(active) == "" || strings.TrimSpace(owner) == "" || owner == active {
+		return false
+	}
+	decision := Decide([]Candidate{{
+		ID:      id,
+		Label:   id,
+		Owner:   owner,
+		Quality: QualityExact,
+	}}, active, ActionWrite)
+	return decision.Kind == KindCrossBlock
+}
+
 // BestQuality 取 query 对多个字段的最高匹配质量。
 func BestQuality(query string, fields ...string) float64 {
 	best := 0.0