Summary

• add an explicit flow:deploy authorization boundary with no flow-owner override
• authorize every flow version referenced by deployment create/update, including unbind-only updates, using the flow's real owner and workspace/project domain
• make explicit/default project and flow-version resolution capability-gated and share-aware while preserving UUID-private 404 responses
• pass authorization evidence into deployment mappers before cross-owner artifact lookup; provider credentials remain scoped to the acting user
• expose deploy through effective permissions and use it, rather than execute, for the frontend deploy button

Authorization contract

• flow:deploy remains an admin-only permission when the Enterprise authorization plugin is active; owning a flow does not imply deploy access
• OSS behavior remains backward-compatible when authorization is disabled or only the pass-through service is registered
• missing, out-of-project, and policy-denied flow/project UUIDs return the same non-disclosing 404
• Enterprise main already grants ("flow:*", "deploy") only through the built-in admin role, so no Enterprise code change is required

Verification

• 135 passed — authorization guards, deployment flow authorization, and admin/effective-permission routes
• 398 passed, 10 skipped — deployment sync, base/watsonx mappers, route handlers, and telemetry tests
• 29 passed — deploy button and effective-permission frontend tests
• 24 passed, 1 xfailed — Enterprise matcher and policy-sync tests on current main
• Ruff check/format, Biome, diff checks, and all commit-time hooks passed

The full frontend TypeScript check is not a clean signal on this release checkout because it reports existing unrelated repository errors; none referenced the changed files.

Refs LE-1827