Event subscription permissions (Trigger Safety 2-A / Visibility Control 2)

[s8sato]

Phase 2: Trigger Scope Restriction via Subscribe Permissions

• Introduce "subscribe permissions" to control which state changes a trigger can listen to.
• Prevents unintended activations and limits cross-account entanglement.

#4937 (comment)