fix(v2): close the defects live probing found - #6681

Staging finally deployed the merged release, so the surface could be
exercised for real. Every fix already shipped held up. These are the
defects only live traffic surfaced, plus the ones a static sweep had
found and left.

A cursor named a position in a sequence without naming the sequence.
`cursorScopeKey` hashed only the caller's filters, so any two lists
filtering on nothing but `workspaceId` produced one fingerprint and
accepted each other's tokens: a tables cursor replayed against the
knowledge list answered 200 and silently skipped a row. Table rows never
reached that check at all, so a cursor from one table paged another.
Identity now comes from the route's own contract — method plus resolved
path — because a hand-written name is the step an author forgets, and
forgetting it is invisible. An unresolved path placeholder throws rather
than fingerprinting the template, so a misconfigured route fails on every
request instead of an unlucky one. Every token minted before this is
refused with an accurate message; they are single-walk and unpersisted.

Knowledge search and the document list answered different questions.
Search grouped same-tag filters by slot and joined them with OR while the
list conjoined every filter, so `gte 9` and `lte 2` on one tag returned
nothing from the list and a full billed page from search. Search now
conjoins. The OR grouping replaced an explicit `|OR|` mechanism that was
deleted outright, was never documented in any contract, and cost the
ability to express a range on a single tag; the union it gave is still
reachable as separate searches. The search body also accepted an
unbounded query that was billed and then silently truncated to the
embedding model's window, and ignored the tag-filter cap the list
enforces.

A body over ten mebibytes was reported as malformed JSON. Next's proxy
truncates there, well under this app's fifty-megabyte ceiling, so the
parse failed on a body the caller sent whole and the size branch was
unreachable. The ceiling is now clamped to what the proxy will pass.

Also: a group's output columns accepted a `workflowGroupId` and discarded
it; an enrichment group could never gain an output, because a new output
coordinate demanded workflow metadata a group with no workflow cannot
have; `newOutputColumns` alone reported success and created nothing; a
saved view stored layout references to columns that do not exist while
refusing the same name in a filter; an MCP server stored `retries: 0` as
three and overrode an explicit auth type; a disabled server answered tool
discovery with an unclassified fault; rotating a header server's headers
left it reading connected; and a run whose workflow was deleted reported
the root folder path while also reporting the workflow deleted.

Where the honest fix was out of reach, the contract was corrected instead
of half-fixing the code: the polled run resource rebuilds `error.code` by
matching the persisted message, so it can never report the two codes that
need block attribution, and now says so. `OUTPUT_TOO_LARGE` is removed —
no path ever emitted it.

`triggers` was left alone deliberately. It reads as a closed enum but
production holds 43 distinct values, because a webhook run stores its
provider id; pinning the enum would refuse legitimate history a log
search exists to find. The description now says the vocabulary is open.

The previous commit clamped the default JSON body cap but left explicit
per-route overrides alone, so a route declaring a larger `maxBodyBytes`
still fell into the truncation it was meant to report: the four inline
workspace-file routes at 70 MB and the deployed-chat route at 220 MB.

Next attaches `proxyClientMaxBodySize` to every request and clones the
body unconditionally for any non-GET method on a matched path, pushing
EOF at ten mebibytes with only a warning, so the handler reads a
truncated prefix. Those routes therefore already fail above that size —
as a malformed-JSON 400. Clamping the effective limit inside the two
body readers makes the same request fail as payload-too-large, quoting
the limit actually in force.

One existing test asserted the unreachable case, allowing a sixty-mebibyte
base64 body; it now asserts what the proxy will forward intact.

The inline-file path still advertises fifty mebibytes and cannot exceed
the proxy ceiling until that ceiling is raised, which changes buffering
for every route and belongs in its own change.

Both are places where a fix in this branch shut one door and left a
smaller one open in the same wall.

Letting an enrichment group gain an output meant skipping workflow
resolution — but that resolution was the only thing validating a new
output, so a PATCH began storing coordinates the runner can never fill.
It fills a cell from `result[out.outputId]` and skips an output with no
`outputId` at all, while the writer diffs on that same id and the sidebar
reads and writes by it; the contract leaves it optional. The regression
test added with that fix was itself asserting such a dead coordinate.
Create's registry checks are now two shared helpers both paths call, and
on update an output is exempt only when an identical binding already
existed, so renaming a group whose enrichment has since changed still
works while anything added or repointed must name a real output.
`mappingUpdates` on an enrichment group now says it is inexpressible
rather than resolving an empty workflow id into a missing workflow.

The layout-reference check was handed the tolerant column set, so a
placeholder minted to keep a dangling filter writable also whitelisted a
brand-new layout reference — storing an entry the next read discards,
which is the inconsistency the check was added to remove. Layout now
resolves against the live columns, which is exactly what pruning keeps,
while filters and sorts keep the exemption they need.