fix(security): content-create divi follows the Divi group switches (audit M2)

The divi input of lit/content-create is refused with unsupported when
lit/divi-insert is disabled or the Divi group is disabled or read-only
(ExposurePolicy::allows as a cross-group gate, asked at execute time).
content-create without divi keeps working. Adds a registrar test that
read-only write tools are never registered, so execute-ability can't
reach them either.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Abilities/ExposurePolicy.php

@@ -196,6 +196,24 @@ final class ExposurePolicy
         ));
     }
 
+    /**
+     * Cross-group gate: whether the ability named $name is among $abilities and not disabled.
+     * lit/content-create's divi input follows lit/divi-insert this way (security M2), so the Divi
+     * group's "nur lesen"/disabled switch also stops Divi layouts written through another group.
+     *
+     * @param list<Ability> $abilities
+     */
+    public function allows(string $name, array $abilities): bool
+    {
+        foreach ($abilities as $ability) {
+            if ($ability->name() === $name) {
+                return $this->mode($ability) !== self::DISABLED;
+            }
+        }
+
+        return false;
+    }
+
     /**
      * @param list<Ability> $abilities
      * @return list<string>