Follow up to: #3576100 **Description:** Global context items are included broadly across AI Context selection, so assigning the global scope should have a dedicated access control path separate from general context item administration. Proposed scope: - Add a new permission, such as `assign global ai context`. - Hide or disable the global scope option for users without the permission. - Preserve existing admin behavior for users with full AI Context administration access. - Optionally log when an item is made global or removed from global scope. - Add functional coverage for users with and without the new permission. This can be added after RC1 because it is an additive permission and access-control improvement with no required schema or API break.