fix: Theme Builder minors of the final review (M-4, M-5, M-6, M-9, M-10, M-11, M-12 c)

- tb-list applies the detached limit after the edit filter (reads up to 500
  IDs) and notes when more are not listed (M-4); an invalid template_id is
  invalid input, shared with ThemeBuilderAccess::template() (M-5).
- Templates carry their status; tb-list notes that a live template outside
  publish (e.g. trashed) can only be switched off (M-10).
- changeableTemplate() refuses without canUse() first, like tb-list and
  tb-create-template; the layout/template refusal difference is documented
  (M-9).
- tb-create-template reads the default template from editableLiveTemplates()
  (M-11); the condition-ID character set (role slugs) is documented (M-6);
  tb-assign documents that a failed reattach keeps Divi's unused marks
  removed (M-12 c).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Integrations/Divi/ThemeBuilder/ThemeBuilderAccessTest.php

@@ -208,6 +208,31 @@ final class ThemeBuilderAccessTest extends TestCase
         );
     }
 
+    /**
+     * Review M-9: without the Theme Builder rights tb-assign and tb-activate refuse like tb-list and
+     * tb-create-template (forbidden, independent of the ID) instead of "Vorlage X gibt es nicht".
+     */
+    public function testChangeableTemplateRefusesWithoutTheThemeBuilderRightsFirst(): void
+    {
+        LibraryFixtures::given([ThemeBuilderFixtures::templatePost(1066)]);
+        $store = ThemeBuilderFixtures::store([ThemeBuilderFixtures::template(1066)]);
+        $rev = ThemeBuilderFixtures::template(1066)->rev();
+
+        foreach ([1066, 4711, 'abc'] as $id) {
+            $refused = ThemeBuilderFixtures::access(['theme_builder'], true, $store)
+                ->changeableTemplate(['template_id' => $id, 'template_rev' => $rev]);
+            self::assertToolError($refused, 'forbidden');
+            self::assertStringNotContainsString((string) $id, self::clientError($refused)['message']);
+        }
+        foreach ([true, false] as $offSwitch) {
+            self::assertToolError(
+                ThemeBuilderFixtures::access(['theme_builder'], true, $store)
+                    ->changeableTemplate(['template_id' => 1066, 'template_rev' => $rev], $offSwitch),
+                'forbidden'
+            );
+        }
+    }
+
     /** Ruling Q18: a template the user may not edit answers like a missing one, also for writing. */
     public function testChangeableTemplateHidesTemplatesTheUserMayNotEdit(): void
     {
@@ -242,13 +267,19 @@ final class ThemeBuilderAccessTest extends TestCase
             ThemeBuilderFixtures::access([], true, ThemeBuilderFixtures::store([
                 ThemeBuilderFixtures::template(1066, ['status' => 'trash']),
             ])),
-            ThemeBuilderFixtures::access(['theme_builder'], true, ThemeBuilderFixtures::store([$trashed])),
+            ThemeBuilderFixtures::access([], true, ThemeBuilderFixtures::store([$trashed]), false),
         ];
         foreach ($notLive as $index => $other) {
             $refused = $other->changeableTemplate($input, true);
             self::assertToolError($refused, 'not_found', (string) $index);
             self::assertSame(self::clientError($missing), self::clientError($refused), (string) $index);
         }
+        // Review M-9: without the Theme Builder rights the refusal does not depend on the ID.
+        self::assertToolError(
+            ThemeBuilderFixtures::access(['theme_builder'], true, ThemeBuilderFixtures::store([$trashed]))
+                ->changeableTemplate($input, true),
+            'forbidden'
+        );
 
         self::assertToolError(
             ThemeBuilderFixtures::access([], false, ThemeBuilderFixtures::store([$trashed]))->changeableTemplate($input, true),