feat(FN-4343): complete Step 3 — enforce workflow step scope invariants

Fusion-Task-Id: FN-4343
Fusion-Task-Lineage: b880b71a-9250-4d9e-bdac-8298a73058f7

packages/core/src/settings-schema.ts

@@ -222,6 +222,7 @@ export const DEFAULT_PROJECT_SETTINGS = {
   postMergeAuditMode: "warn",
   mergeAuditAutoRecovery: "ai-assisted",
   workflowStepTimeoutMs: 360_000,
+  workflowStepScopeEnforcement: "block",
   workflowRevisionForkOnScopeMismatch: true,
   strictScopeEnforcement: false,
   buildRetryCount: 0,

packages/core/src/types.ts

@@ -2309,6 +2309,11 @@ export interface ProjectSettings {
    *  given one shot to retry with the configured fallback model before the
    *  step is reported as failed. Default: 360_000 (6 minutes). */
   workflowStepTimeoutMs?: number;
+  /** How pre-merge prompt workflow steps enforce declared File Scope at step end.
+   *  - "block" (default): mark the step failed/revision-requested on off-scope writes
+   *  - "warn": log off-scope writes but allow the step to pass
+   *  - "off": disable workflow-step scope enforcement and keep legacy behavior */
+  workflowStepScopeEnforcement?: "block" | "warn" | "off";
   /** When true (default), workflow revision feedback that explicitly names files
    *  outside the task's declared File Scope is forked into a dependent follow-up
    *  task instead of being appended to the original PROMPT.md. Set to false to