Say more about a thread without superseding it

Attaches; both stay live. A clarification NEVER moves the current line — if the line moved, that was an amend and must be written as one, so that an audit can tell 'we said it more plainly' from 'we said something else'.

Requires the coord:write scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying coord:write is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include coord:write — mint a key with it explicitly (POST /v2/workspaces/{id}/keys).