Automations: permission scopes (private vs project-shared)

Split from #242. Automations live in the local store today, so every automation is private to this machine. "Project-shared" needs a shared home first (e.g. a committed .solenta/automations file loaded per project, with trust-gating like repoConfig's trust hash), then a scope field on AutomationInfo.

Decide whether shared automations may fire on every teammate's machine (duplicate runs on each GitHub event) or need a single owner.

Decision: local opt-in runner.

Shared automations live in a committed file, trust-gated like solenta.json.
The file is the definition only. Auto-fire only on machines that opt in (the creator opts in automatically).
Run now still works on any trusted machine.
Runtime state (cursor, last run, memory, failure streak) stays local — it cannot live in git.

Design next, then implementation.

Spec drafted at docs/superpowers/specs/2026-10-11-automation-permission-scopes-design.md (not committed yet).

Shared definitions live in solenta.json (automations array), not .solenta/ (gitignored).
Separate automationsTrust hash from command trust.
scope: private | project; enabled = run on this machine; teammates start off.
Runtime state stays in the local overlay.
Waiting on spec review before the implementation plan.

Implementation plan: docs/superpowers/plans/2026-10-11-automation-permission-scopes.md (8 tasks, TDD).

Spec deviation locked in the plan: there is no projects:changed push today, so trustFile is followed by api.projects.list() instead of a new channel.

Waiting on execution choice (subagent-driven vs inline) before touching product code.

Executing the plan via subagent-driven development. Task 1 in progress: parse/hash/present the automations section of solenta.json.

Final-review blockers fixed in f3f1b2b: runNow fires the merged file row; automations:trustFile classified in webScopes; listRuns resolves via merge (empty history for overlay-less shared ids); approve-and-run refreshes projects. Covering suite 79 electron + 33 renderer + typecheck green. Whole-branch re-review in flight.

Whole-branch re-review is clean (0 Critical, 0 Important). HEAD 88e934d. Covering suite + typecheck re-run as part of finish. Waiting on merge locally / PR / keep / discard.

PR open: #1605 (branch coder/automations-permission-scopes-private-vs-bdf997 @ 88e934d). Worktree kept for review. Do not close #1590 until the PR merges. Expect conflicts with #1588/#1604 and #1599 on automations files.

Merged origin/main into #1605. Only conflict was electron/automation-triggers.js: fireRun now uses the merged file row and main's Linear/Sentry trigger-note title. Covering 88 electron + 35 renderer + typecheck green. HEAD 7f281fe.