feat: advance local-first workspace checklist

- add admin access-policy UI and local access control surfaces

- add local markdown conflict resolution UI and smoke coverage

- add ACP local agent changed-files audit scaffold and read-only write guard

- document current P0-P2 checklist progress and verification evidence

rust/crates/core-protocol/src/lib.rs

@@ -11,8 +11,8 @@ pub mod search;
 pub mod tool;
 
 pub use ai::{
-    AiEvent, AiEventKind, AiRuntimeOwner, AiSession, AiStructuredWriteKind,
-    AiStructuredWriteResult, AiToolCall,
+    AiAccessPermissionLevel, AiAccessScope, AiEvent, AiEventKind, AiRuntimeOwner, AiSession,
+    AiShareContext, AiStructuredWriteKind, AiStructuredWriteResult, AiToolCall,
 };
 pub use command::{
     CommandEnvelope, CopyTreeDocumentPages, CreateDocumentPage, CreatePage, CreateWorkspace,
@@ -48,8 +48,8 @@ pub use kernel::{
     KernelProjectionFilter, KernelProjectionItem, KernelProjectionKind, KernelProjectionRequest,
     KernelProjectionResourceKind, KernelProjectionResourceMeta, KernelProjectionResult,
     KernelProjectionRowKind, KernelRefsPayload, KernelSubtreeRef, KernelSubtreeResult,
-    KernelTraverseGraph, KernelUpdateNode, WorkspaceSource, WorkspaceSourceCapability,
-    WorkspaceSourceKind,
+    KernelTraverseGraph, KernelUpdateNode, PageBodyWriteRequest, WorkspaceSource,
+    WorkspaceSourceCapability, WorkspaceSourceKind,
 };
 pub use mindmap::{
     MindmapAdapterProjection, MindmapAssociativeLine, MindmapCommand, MindmapKernelCapabilities,
@@ -289,6 +289,7 @@ mod tests {
                 content: serde_json::json!([]),
                 revision: serde_json::json!(7),
                 conflict_detection_key: serde_json::json!("page_1:7"),
+                file_version: serde_json::json!(null),
                 block_document: serde_json::json!({
                     "documentId": "page_1",
                     "rootBlockIds": [],