[P0][security] Permission lifecycle ops ungated (allowTransfer/allowRestore/allowPurge)

[os-zhuang]

Part of the metadata liveness audit umbrella #1878 (P0 security cluster).

Problem

Destructive record lifecycle operations are not gated by RBAC. allowTransfer / allowRestore / allowPurge are omitted from OPERATION_TO_PERMISSION (permission-evaluator.ts:8-16), so:

• ownership transfer,
• undelete (restore), and
• hard-delete / GDPR purge

run without any permission check. These are exactly the operations that most need RBAC gating.

Decision required (enforce or remove)

• Enforce: add transfer/restore/purge entries to OPERATION_TO_PERMISSION and ensure the corresponding routes/services consult the evaluator before executing.
• Remove: if these ops are intentionally unrestricted, drop the allowTransfer/allowRestore/allowPurge permission props from the spec.

Evidence

• docs/audits/2026-06-security-identity-property-liveness.md
• permission-evaluator.ts:8-16 (OPERATION_TO_PERMISSION)

[os-zhuang]

Disposition (ADR-0049): mark experimental now; enforce with the feature later.

Verified against current code:

• permission.zod.ts:28-30 declares allowTransfer/allowRestore/allowPurge, but no transfer/restore/purge ObjectQL operation exists and nothing maps these bits — they are dangling, not just unmapped.
• Root cause compounding it: permission-evaluator.ts fails open (if (!permKey) return true) for unknown operations, so a future destructive op added without a map entry would be silently ungated.

Done in PR A (fix/p0-unenforced-security-props-1878): evaluator now fails closed for the destructive op class; the three bits marked [EXPERIMENTAL — not enforced]. The real RBAC gating is re-introduced with the transfer/restore/purge feature (M2). This issue stays open to track that.

[os-zhuang]

Triage (2026-06-27, for 11.0 epic #2364): acceptable interim, not a blocker. allow{Transfer,Restore,Purge} are [experimental] in spec; permission-evaluator.ts has a fail-closed DESTRUCTIVE_OPERATIONS gate, but the transfer/restore/purge ops don't exist in ObjectQL yet. Enforcing later = additive/non-breaking. 11.0 decision: build+enforce, or keep formally experimental.