fix(security): content-create divi follows the Divi group switches (audit M2)

The divi input of lit/content-create is refused with unsupported when
lit/divi-insert is disabled or the Divi group is disabled or read-only
(ExposurePolicy::allows as a cross-group gate, asked at execute time).
content-create without divi keeps working. Adds a registrar test that
read-only write tools are never registered, so execute-ability can't
reach them either.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Abilities/AbilityRegistrarTest.php

@@ -236,4 +236,28 @@ final class AbilityRegistrarTest extends TestCase
         (new AbilityRegistrar($registry, (new ExposurePolicy(['@group:divi' => 'disabled']))->withGroups($registry->groupMap())))
             ->registerAbilities();
     }
+
+    /**
+     * Security M2 follow-up: a write tool of a "nur lesen" group is never registered, so
+     * mcp-adapter-execute-ability cannot reach it either (it resolves abilities via
+     * wp_get_ability()); the group's read tools stay.
+     */
+    public function testReadonlyGroupWriteAbilitiesAreNotRegisteredForExecuteAbilityEither(): void
+    {
+        $write = Mockery::mock(Ability::class);
+        $write->allows('name')->andReturn('lit/divi-insert');
+        $write->allows('isDirect')->andReturn(true);
+        $write->allows('annotations')->andReturn(['readonly' => false]);
+        $read = $this->ability();
+        $read->allows('name')->andReturn('lit/test');
+        $integration = Mockery::mock(Integration::class);
+        $integration->allows('id')->andReturn('divi');
+        $integration->allows('isAvailable')->andReturn(true);
+        $integration->allows('abilities')->andReturn([$write, $read]);
+        $registry = new IntegrationRegistry($integration);
+        Functions\expect('wp_register_ability')->once()->with('lit/test', Mockery::type('array'));
+
+        (new AbilityRegistrar($registry, (new ExposurePolicy(['@readonly:divi' => true]))->withGroups($registry->groupMap())))
+            ->registerAbilities();
+    }
 }