Set the code-sync policy

Choose who may stage code-defined schemas for this project: publishable_key lets the browser key stage from an allowed origin, trusted_only requires an authenticated sync token. This changes who can act, so it is outward-facing (Tier B). The write takes the project's code-sync lock, so it is serialized against in-flight syncs. Scope: workspace:manage.