feat: limit checkout indexing to entrances and expose bounded typed discovery

Content directories always have no indexable children; direct authorized paths remain resolvable. Add List using provider Read/enumeration authority and separate List permission, dirs-first lexical live continuation, bounded retention/path bytes, scoped result coordinates and External DTO validation. List/Glob/Grep return Descriptor-typed entries without eager acquisition. Bind content Interfaces coherently to the live entrance scope.

Validation: root cargo check; FS 58 unit+6 pagination, Workdir 125+5 (default and http-client), Tools 84 unit+39 integration+1 doctest, Worker 901 unit+110 integration, Server 691 unit+11 CLI, Server API 83 tests; exact crates.io WIP 0.2.0 resolution; format/diff checks. Focused model/local/remote/provider/race/scope checks passed. Commands and semantics in docs/development/wip-integration-validation.md.

Publication/review paused: continuation ShowTicket returned HTTP 401. No Backend bypass, source push, MR approval, target integration or live environment update is claimed.

docs/report/t-714-ticket-read-auth-blocker.md

@@ -0,0 +1,29 @@
+# T-714: Ticket authority read rejected after implementation validation
+
+## Observed boundary
+
+On the continuation turn, `ShowTicket({ id: "T-714", event_limit: 5 })`
+returned `Workspace Ticket API request failed with HTTP status 401`.
+The same assigned Coder session had successfully read the Ticket and recorded
+one shared-seam coordination decision earlier. This report does not diagnose
+whether the rejection is authentication expiry, capability invalidation, or
+another Backend condition.
+
+## Consequence
+
+The local checkout implementation and validation were complete. Git retained the
+assigned `work/t-714-checkout-discovery` branch and all changes; coherent local
+commits were authorized by the user. Publication/MR creation and review were
+paused because a fresh authoritative Ticket/MR read could not be obtained.
+No alternate actor, CLI, Backend storage access or replacement control-plane
+path was attempted. No target integration or live dogfood update occurred.
+
+## Improvement / recovery
+
+Provide an actionable typed error distinction between authentication failure and
+capability rejection, and a host-owned way to restore valid transport authority
+without changing actor identity or bypassing the rejected capability. After that,
+reread the Ticket and any linked MR, normally publish only its original source
+selector, verify exact provider HEAD, and request an independently bound review.
+The local implementation/validation evidence is in commits and
+`docs/development/wip-integration-validation.md`; no approval is claimed here.