fix: harden Web UX capture profiles

tools/web-ux/scenarios/anonymous-entry.json

@@ -23,6 +23,15 @@
       "dataState": "Fresh browser context with no cookies, local storage, or session state.",
       "ready": { "kind": "network-idle", "timeoutMs": 15000 },
       "capturePoints": [{ "id": "initial", "label": "Anonymous entry", "fullPage": true }]
+    },
+    {
+      "id": "account",
+      "label": "Account entry",
+      "path": "/account",
+      "goal": "Understand current authentication state and the available account action without Workspace-private content.",
+      "dataState": "Fresh browser context with no cookies, local storage, or session state.",
+      "ready": { "kind": "network-idle", "timeoutMs": 15000 },
+      "capturePoints": [{ "id": "initial", "label": "Anonymous account screen", "fullPage": true }]
     }
   ]
 }

tools/web-ux/scenarios/workspace-control-plane.json

@@ -57,6 +57,15 @@
       "ready": { "kind": "selector", "selector": "main", "timeoutMs": 20000 },
       "capturePoints": [{ "id": "initial", "label": "Worker list", "fullPage": true }]
     },
+    {
+      "id": "settings",
+      "label": "Workspace settings",
+      "path": "/w/${WORKSPACE_ID}/settings",
+      "goal": "Reach the relevant Workspace settings area without presenting owner-only destinations as usable actions to a non-owner.",
+      "dataState": "Current permission projection for the selected Workspace.",
+      "ready": { "kind": "selector", "selector": "main", "timeoutMs": 20000 },
+      "capturePoints": [{ "id": "initial", "label": "Workspace settings", "fullPage": true }]
+    },
     {
       "id": "repositories",
       "label": "Repository settings",
@@ -65,6 +74,17 @@
       "dataState": "Workspace repository catalog projected through current permissions.",
       "ready": { "kind": "selector", "selector": "main", "timeoutMs": 20000 },
       "capturePoints": [{ "id": "initial", "label": "Repository settings", "fullPage": true }]
+    },
+    {
+      "id": "repository-access",
+      "label": "Repository access",
+      "path": "/w/${WORKSPACE_ID}/settings/repository-access",
+      "goal": "Review credential and host-trust bindings as an owner and verify non-owner composition fails closed without secret material.",
+      "dataState": "Configured repository access bindings projected without credential bytes.",
+      "ready": { "kind": "selector", "selector": "main", "timeoutMs": 20000 },
+      "capturePoints": [
+        { "id": "initial", "label": "Repository access settings", "fullPage": true }
+      ]
     }
   ]
 }