Issue #3586356: Harden CCC context item access checks and document the authoring trust model.

Description

Hardens context-item access enforcement and documents the authoring trust model. This is not a permission redesign; broader consume-vs-UI separation is tracked in #3586357 for 1.1.

Changes

• Listing: AiContextItemListBuilder filters rows with $entity->access('view') and bubbles access cacheability, so unpublished items owned by others are not disclosed in listing metadata.
• Form: ?parent= prefills only when the parent entity is viewable.
• Docs/permissions: README trust model; permission descriptions; config docs. Clarifies that authors are trusted with prompt-level influence, and that access published ai context covers published-item view access used by UI and AI consumption paths for the current user.
• Tests:
  • Functional listing coverage for others’ unpublished vs own unpublished
  • Functional ?parent= access coverage
  • Kernel access matrix for item/usage handlers and overview/usage access checks

No new permissions. No breaking API changes.

Testing instructions

1. As a user with only view ai context items (no unpublished permission):
   • Create a published item and an unpublished item owned by another user.
   • Visit /admin/config/ai/context/items.
   • Confirm the published item appears and the other user’s unpublished item does not.
2. As a user with view ai context items who owns an unpublished item:
   • Confirm that own unpublished item still appears in the listing.
3. With subcontext enabled, as a user with create ai context item but without unpublished view access:
   • Open /admin/config/ai/context/items/add?parent={unpublished_other_id}.
   • Confirm the inaccessible parent label is not prefilled / shown.
4. Review People → Permissions and README trust-model text for authoring trust + access published ai context wording.
5. drush cr if needed. No config import required.

Automated:

ddev phpunit web/modules/contrib/ai_context/tests/src/Kernel/AiContextAccessControlMatrixTest.php
ddev phpunit --filter testListingHidesOthersUnpublishedItemsWithoutPermission web/modules/contrib/ai_context/tests/src/Functional/AiContextItemListTest.php
ddev phpunit --filter testListingShowsOwnUnpublishedItems web/modules/contrib/ai_context/tests/src/Functional/AiContextItemListTest.php
ddev phpunit --filter testParentQueryParamRequiresViewAccess web/modules/contrib/ai_context/tests/src/Functional/AiContextItemFormTest.php

Checklist

• I have updated the MR title to use format: Issue #1234: My issue title.
• I have updated the MR description to include: Closes #1234
• I have performed a self-review of my own code
• I have added or updated tests, or explained in the description why this change is not covered by tests
• I have updated documentation for any new or changed functionality
• I have written testing instructions and verified them locally
• I have noted any required post-merge steps (config imports, cache rebuilds, manual changes)
• This MR contains no breaking API or hook changes, or they are explicitly documented in the description

AI Compliance

Note

Check the one that best describes your usage, or leave all unchecked if AI was not significantly used.

• AI Assisted Code
  Mainly written by a human; AI used for autocomplete or partial generation under full human supervision.

• AI Generated Code
  Mainly generated by AI, reviewed and approved by a human before this MR was created.

• Vibe Coded
  Generated by AI and only functionally reviewed before this MR was created.

Closes #3586356