M8.1: Secure-by-default cube access

A security-hardening point release on top of M8.

Cubes are now closed by default

The Phase 7 security model shipped with ungranted cubes open to any authenticated user (chosen to avoid changing the pre-security behavior). That prioritized migration continuity over fail-closed, which is the wrong default for the phase that adds least privilege. This release flips it.

• Closed by default (fail-closed). A cube with no grants is now denied to non-admins; access is opened only by an explicit grant. This is the secure, least-privilege posture an operator gets out of the box. Admins always bypass; deleting a cube and managing its grants remain admin-only.
• Open by opt-in. Deployments inside one trusted organization that want zero per-cube grant friction can set EPIPHANY_DEFAULT_CUBE_ACCESS=open to restore the open posture (ungranted cube writable by any authenticated user, never admin). The server logs a warning when this is enabled.

In both postures the first grant on a cube makes it "managed" and access is then exactly the grants plus admin bypass.

ADR-0015 decision 2a is amended to document both postures and why the default changed. A new acceptance suite (epiphany-api/tests/cube_default_access.rs) proves the secure default end to end -- a non-admin is denied an ungranted cube and admitted only by a grant -- and the opt-in open posture.

This addresses reviewer feedback that closed-unless-granted is the safer, standard secure-by-default posture. The full test suite is green and the supply-chain audit passes; binaries for Linux x86_64/aarch64, Windows x86_64, and macOS aarch64 are attached once CI builds them.