feat(channels): add context capability admin surface

Squash merge PR #115 after resolving changelog and SQLite migration-map conflicts with current dev. Renumbered channel-context PostgreSQL migration to 000075 and bumped PG required schema to 75 plus SQLite schema to 44 so it follows the run timeline migration. Local checks passed: go test ./..., go build ./..., go build -tags sqliteonly ./..., go vet ./..., and pnpm -C ui/web build. PR CI run 26705617311 passed release-versioning, go, and web.

internal/store/sqlitestore/secure-cli.go

@@ -437,7 +437,11 @@ func (s *SQLiteSecureCLIStore) LookupByBinary(ctx context.Context, binaryName st
 	query += ` LIMIT 1`
 
 	row := s.db.QueryRowContext(ctx, query, args...)
-	return s.scanRowWithGrantAndUserEnv(row)
+	b, err := s.scanRowWithGrantAndUserEnv(row)
+	if err != nil || b == nil {
+		return b, err
+	}
+	return s.applyContextSecureCLI(ctx, b)
 }
 
 func (s *SQLiteSecureCLIStore) scanRowWithGrantAndUserEnv(row *sql.Row) (*store.SecureCLIBinary, error) {
@@ -524,6 +528,60 @@ func (s *SQLiteSecureCLIStore) scanRowWithGrantAndUserEnv(row *sql.Row) (*store.
 	return &b, nil
 }
 
+func (s *SQLiteSecureCLIStore) applyContextSecureCLI(ctx context.Context, b *store.SecureCLIBinary) (*store.SecureCLIBinary, error) {
+	scopes := store.ChannelContextScopeChainFromContext(ctx)
+	if len(scopes) == 0 || b == nil {
+		return b, nil
+	}
+	hasUserCredential := len(b.UserEnv) > 0 || b.UserCredentialType != nil || b.UserHostScope != nil
+	disabledByContext := false
+	for _, scope := range scopes {
+		grants, err := s.ListContextGrantsForScope(ctx, scope)
+		if err != nil {
+			return nil, err
+		}
+		for _, contextGrant := range grants {
+			if contextGrant.BinaryID != b.ID {
+				continue
+			}
+			if !contextGrant.Enabled {
+				disabledByContext = true
+				break
+			}
+			grant := &store.SecureCLIAgentGrant{
+				DenyArgs:       contextGrant.DenyArgs,
+				DenyVerbose:    contextGrant.DenyVerbose,
+				TimeoutSeconds: contextGrant.TimeoutSeconds,
+				Tips:           contextGrant.Tips,
+				EncryptedEnv:   contextGrant.EncryptedEnv,
+			}
+			b.MergeGrantOverrides(grant)
+			disabledByContext = false
+			break
+		}
+	}
+	if disabledByContext {
+		return nil, nil
+	}
+	for _, scope := range scopes {
+		creds, err := s.GetContextCredentialsForScope(ctx, scope, b.ID)
+		if err != nil {
+			return nil, err
+		}
+		if creds == nil || len(creds.EncryptedEnv) == 0 {
+			continue
+		}
+		if !hasUserCredential {
+			b.UserEnv = creds.EncryptedEnv
+			b.UserCredentialType = creds.CredentialType
+			b.UserHostScope = creds.HostScope
+		} else {
+			b.EncryptedEnv = creds.EncryptedEnv
+		}
+	}
+	return b, nil
+}
+
 // ListEnabled returns all enabled configs.
 func (s *SQLiteSecureCLIStore) ListEnabled(ctx context.Context) ([]store.SecureCLIBinary, error) {
 	query := `SELECT ` + secureCLISelectCols + ` FROM secure_cli_binaries WHERE enabled = 1`