Adapt sysadmin.AuthorOnlyPolicySource at the composition root so projectinstance stays within module-boundary allowlists. Co-authored-by: Cursor <cursoragent@cursor.com>