fix(security): content-create divi follows the Divi group switches (audit M2)

The divi input of lit/content-create is refused with unsupported when
lit/divi-insert is disabled or the Divi group is disabled or read-only
(ExposurePolicy::allows as a cross-group gate, asked at execute time).
content-create without divi keeps working. Adds a registrar test that
read-only write tools are never registered, so execute-ability can't
reach them either.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Plugin.php

@@ -68,9 +68,18 @@ final class Plugin
 
         $schema = self::contentSchema();
         $divi = new DiviIntegration($schema, $changeLog);
+        $registry = null;
+        $policy = null;
+        // Security M2: content-create's divi input follows lit/divi-insert (asked at execute time,
+        // when registry and policy exist), so the Divi group's switches stop every Divi layout write.
+        $diviWritable = static function () use (&$registry, &$policy): bool {
+            return $registry instanceof IntegrationRegistry
+                && $policy instanceof ExposurePolicy
+                && $policy->allows('lit/divi-insert', $registry->abilities());
+        };
         $registry = new IntegrationRegistry(
             new CoreIntegration(self::pluginDir() . '/docs/guides'),
-            new WordPressIntegration($schema, $changeLog, $divi->contentComposer()),
+            new WordPressIntegration($schema, $changeLog, $divi->contentComposer($diviWritable)),
             new MediaIntegration($schema, $changeLog, $limits),
             $divi
         );