fix(executor): seed run-wide access key lists and scope exact-key cache grants - #7850

Summary

• Child executors started with no largeValueKeys / fileKeys lists, so the ??= [] append a block makes landed on its per-block context copy and was dropped. Seed both lists in createExecutionContext: top-level runs keep the lists they pass in, child executors get their own empty lists and never the parent's (an exact key is an access grant, so sharing would widen access across custom blocks)
• The sync large-value cache honored an exact key grant without checking the key's workspace and workflow, while the async storage check refuses a key from another workspace/workflow before looking at grants. Both now call one isGrantedLargeValueKey predicate
• Correct the executionFilesById TSDoc: the index is built per block from block states, not shared across the run
• Investigated making the execution file index run-scoped and did not: agent tool results already land in block outputs, so later blocks find those files, and a run-wide index would expose files from failed blocks and names recorded before output redaction

Type of Change

• Bug fix

Testing

• New tests: keys recorded on a block copy reach the run, passed-in lists are shared by reference, a granted key from the same workflow is served from cache, a granted key for another workspace/workflow or a scope without one is refused
• Verified the new tests fail against the old code
• Affected vitest suites, type-check, lint, check:audits all pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)