fix(site): allow editing parameters when the template forces an update - #29795

Fixes #19676

Problem

When a template has require_active_version enabled and the workspace is outdated, the workspace parameters form was disabled in its entirety for any user without template update permission, which in practice means every Member.

const disabled =
	workspace.outdated &&
	workspace.template_require_active_version &&
	!canChangeVersions;

canChangeVersions is permissions.updateWorkspaceVersion, an authz check for action: "update" on the template, so only template admins and owners satisfy it. disabled was then OR'd into the isDisabled of every field and into the submit button, so even parameters the new template version did not touch were locked.

The result is a deadlock. If a new version adds a validation the workspace's current parameter values do not satisfy, the forced update fails, the user is sent to the parameters page to fix the values, and the form is read-only. The user cannot start their workspace at all. This reproduces on both entry paths: clicking "Update and restart" first, and going to the parameters page first.

Fix

A user who cannot pin versions can only ever submit a build against the active version, so there is nothing to protect against by locking the form. Instead of disabling it, the page now evaluates and submits parameters against workspace.template_active_version_id whenever require_active_version is set and the user lacks the permission.

• WorkspaceParametersPage.tsx derives the target version from the active version in that case, which drives both the dynamic parameters websocket and the template_version_id on the resulting build.
• WorkspaceParametersPageView.tsx drops the blanket disabled flag. Immutable parameters, styling.disabled parameters, and the in-flight submit state still disable fields exactly as before.
• The warning alert ("Update the workspace to edit parameters") is replaced with an informational one explaining that these are the latest version's parameters and that submitting will update the workspace.

Behaviour for users who can change versions is unchanged.

Tests

• New unit test in WorkspaceParametersPage.test.tsx: a user without updateWorkspaceVersion on an outdated require_active_version workspace gets an editable form, an enabled submit button, and parameters evaluated against the active version. Immutable parameters stay disabled. Verified that it fails without the source change.
• Updated the two RequireActiveVersion* stories to assert the form is now usable.
• pnpm run check, pnpm run format:check, pnpm run lint:oxlint, tsc --noEmit, and both the unit and storybook test runs for this page pass locally.