Fix admin contribution grant bridge

[intel352]

Summary

• Keeps contribution register/list steps on the legacy execution path while advertising honest proto_with_legacy_struct contracts.
• Allows step.admin_list_contributions to consume contribution outputs from prior Workflow steps, which makes external plugin contribution composition work without process-local registry shortcuts.
• Bridges only the authenticated user's granted permissions into admin iframe tools and keeps a single active contribution nav item.

Verification

• GOWORK=off go test ./internal
• Scenario 90 full Docker run from workflow-scenarios with this worktree: PASS=96 FAIL=0
• Scenario 90 Playwright CLI exploratory test: 1 passed

[Copilot]

Pull request overview

This PR fixes the admin contribution “bridge” so contribution registration/listing stays on the legacy (map-shaped) execution path while the plugin advertises proto_with_legacy_struct contracts, enabling contribution composition across workflow steps without relying on process-local registry shortcuts. It also tightens the UI’s permission-grant bridging so admin iframe tools receive the authenticated user’s granted permissions and the nav maintains a single active contribution item.

Changes:

• Switch step.admin_register_contribution / step.admin_list_contributions contracts to proto_with_legacy_struct while keeping those step types on the legacy StepInstance execution path.
• Allow step.admin_list_contributions to consume contribution outputs from prior workflow steps (via contribution_steps) and filter contributions by granted permissions.
• Update the embedded admin UI to pass granted_permissions through to iframe tools and ensure only one contribution nav item is marked active.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
plugin.contracts.json	Updates step contract modes for contribution steps to proto_with_legacy_struct.
internal/ui_dist/index.html	Bridges granted permissions into iframe auth responses; improves nav active-state handling.
internal/step_admin.go	Adds legacy step support for aggregating contributions from prior step outputs; adds typed-step fallbacks for missing inputs.
internal/step_admin_test.go	Updates tests for map-shaped contribution arrays and validates legacy execution for contribution steps.
internal/registry.go	Refactors permission-based listing/filtering path (noted perf/lock behavior in review comment).
internal/plugin.go	Limits typed step exposure to non-contribution steps; sets contribution step contract mode explicitly.
internal/plugin_contracts_test.go	Verifies contract mode matches runtime registry and manifest.
internal/module_dashboard.go	Enables list filtering over provided contributions and normalizes legacy output shapes.
internal/module_dashboard_test.go	Updates assertions for contribution list output shape ([]any).
internal/assets_test.go	Ensures embedded UI contains the new granted_permissions wiring.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.