fix: Theme Builder minors of the final review (M-4, M-5, M-6, M-9, M-10, M-11, M-12 c)

- tb-list applies the detached limit after the edit filter (reads up to 500
  IDs) and notes when more are not listed (M-4); an invalid template_id is
  invalid input, shared with ThemeBuilderAccess::template() (M-5).
- Templates carry their status; tb-list notes that a live template outside
  publish (e.g. trashed) can only be switched off (M-10).
- changeableTemplate() refuses without canUse() first, like tb-list and
  tb-create-template; the layout/template refusal difference is documented
  (M-9).
- tb-create-template reads the default template from editableLiveTemplates()
  (M-11); the condition-ID character set (role slugs) is documented (M-6);
  tb-assign documents that a failed reattach keeps Divi's unused marks
  removed (M-12 c).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/Divi/ThemeBuilder/ThemeBuilderAccess.php

@@ -19,7 +19,12 @@ defined('ABSPATH') || exit;
  * Builder page, theme-builder.php:2059-2063, ruling Q15) and the Divi role option theme_builder (off for
  * every role but administrator by default, F12); one layout or template additionally edit_post on it.
  * Without those, or with the group "Divi Theme Builder" disabled, every TB ID answers like a missing ID
- * (P12 pattern). The group's "nur lesen" stops writes (E9). Not final so abilities can be tested with a mock.
+ * (P12 pattern); the Theme Builder tools themselves (tb-list, tb-create-template, tb-assign, tb-activate) refuse
+ * without canUse() as forbidden, whatever the ID (review M-9). With the Theme Builder rights, a template the user
+ * may not edit still reads like a missing one (template(), ruling Q18 – templates are listed by tb-list), while a
+ * layout without edit_post answers forbidden (layout(): only accounts with the Theme Builder rights get there, and
+ * tb-list names the layout IDs of their templates). The group's "nur lesen" stops writes (E9). Not final so
+ * abilities can be tested with a mock.
  */
 class ThemeBuilderAccess
 {
@@ -146,10 +151,7 @@ class ThemeBuilderAccess
     {
         $id = PostGuard::id($templateId);
         if ($id === null) {
-            return Errors::invalidInput(
-                'template_id fehlt oder ist keine ID.',
-                ['template_id' => 'ID aus lit/tb-list']
-            );
+            return self::invalidTemplateId();
         }
 
         $post = get_post($id);
@@ -168,6 +170,12 @@ class ThemeBuilderAccess
         return $forWrite ? ($this->writableGate() ?? $post) : $post;
     }
 
+    /** The answer for a template_id that is missing or no ID (template(), lit/tb-list – review M-5). */
+    public static function invalidTemplateId(): WP_Error
+    {
+        return Errors::invalidInput('template_id fehlt oder ist keine ID.', ['template_id' => 'ID aus lit/tb-list']);
+    }
+
     /**
      * A template the Theme Builder tools may change (lit/tb-assign, lit/tb-activate): rights and group gate
      * (template(), a template the user may not edit reads as missing – ruling Q18), no Theme Builder draft (E7),
@@ -180,6 +188,12 @@ class ThemeBuilderAccess
      */
     public function changeableTemplate(array $input, bool $offSwitch = false): Template|WP_Error
     {
+        // Review M-9: without the Theme Builder rights refuse like tb-list/tb-create-template – independent of the ID.
+        $refusal = $this->canUse();
+        if ($refusal !== null) {
+            return $refusal;
+        }
+
         $post = $this->template($input['template_id'] ?? null, true);
         if ($post instanceof WP_Error) {
             $id = $offSwitch && Errors::codeOf($post) === 'not_found'