diagram sharing phase 2: child-entity (nodes/edges) write enforcement

[fabracht]

Phase 2 of diagram sharing (design: docs/design/diagram-sharing.md). Phase 1 (#76) gates only the ownership-enabled parent entity.

Problem

Child entities (e.g. a diagram's nodes/edges) have no write protection — they are only obscured behind the parent's UUID. Any authenticated user who knows a child id (or the parent id) can read/update/delete child records regardless of the parent's ownership or _shares grants.

Scope

• Derive access on child entities from the parent's ownership + _shares grant via the relationship/scope config (ScopeConfig).
• Read child requires view on the parent; create/update/delete child requires edit on the parent.
• Deleting the parent cascades to children (and their grants are already cleared with the parent in phase 1).
• Apply on the agent CRUD path first; cluster path tracked in cluster parity for diagram sharing #75.

References

• Design: docs/design/diagram-sharing.md
• TLA: specs/DiagramSharingCurrent.tla (InvChildNeedsParentEdit is violated by current behavior)
• Phase 1: add agent-mode diagram sharing #76 · Cluster parity: cluster parity for diagram sharing #75