#953 rate_limits: limit_scope=workflow unsupported on TokenGate path (needs per-run subject + assignment)

EARS: If a rate limit uses limit_scope=workflow, then the API shall reject it (400 INVALID_SCOPE) and the limiter shall deny the call, until per-run subjects are designed. Option: subject <tenant>:run:<id> assigned by a constrained assignments:write key (plan_ids constraint) on first use; costs one admin call per run. Decide with TokenGate. From #928.