docs: specify explicit flow permission grants

[osolmaz]

Summary

• add a dedicated spec for explicit per-flow permission requirements
• link the flow permission model from the flows architecture doc
• define the explicit-grant rule, preflight failure behavior, and runtime propagation requirements

Validation

• pnpm run check:docs

[osolmaz]

Landed via temp rebase onto main.

• Gate: validation completed for this repo's change scope
• Land commit: ceecd25
• Merge commit: 429b030

Thanks @osolmaz!