enhancement: track resource boundary consistency improvements

[WH-2099]

Overview

This parent issue tracks engineering follow-ups to make resource boundary checks more consistent across routes, serializers, async tasks, runtime services, and plugin or agent service boundaries.

The common pattern is that one layer has the expected workspace, app, dataset, user, credential, runtime, or package context, while a later layer handles a nested identifier without carrying that context all the way through.

The sub-issues below group the work by behavior area and include concrete code locations for review.

Sub-issues

• enhancement: file reference and lifecycle boundary consistency #37984 File reference and lifecycle boundaries
• enhancement: object ownership binding consistency #37985 Object ownership checks for nested ids
• enhancement: credential visibility and usage boundary consistency #37986 Credential visibility and usage boundaries
• enhancement: runtime task, HITL, and async boundary consistency #37987 Runtime task, HITL, and async boundaries
• enhancement: resource-level permission consistency #37988 Resource-level permission checks
• enhancement: temporary capability and pending import ownership consistency #37989 Temporary capability ownership checks
• enhancement: plugin daemon, agent backend, and package boundary consistency #37990 Plugin daemon, agent backend, and package boundaries

Behavioral impact

These patterns can produce reads, writes, signed URLs, runtime actions, pending import consumption, package reuse, or service actions outside the scope that the caller-facing route appears to represent.

Detailed code locations are listed in the sub-issues.

No implementation proposal is included here.