d1cab68e3d
Let tenant-wide retrieve keys serve tenant-bounded /files paths while denying KB-restricted keys, declare knowledge batch write routes for ingest-capable keys, and short-circuit ownership checks for API-key principals already authorized by the gate and KB allow-list.