Serve vfolder access decisions from the virtual entity chain

Replace the hand-written accessibility union (query_accessible_vfolders, models/vfolder/row.py - owner, invited via the legacy vfolder_permissions table, project, model-store; about ten call sites including the mount path and the model-serving/deployment repositories) with graph resolution: enrolled in the scope AND accessible to the requester. Wire the vfolder actions behind the RBAC gate. Once reads walk the graph, entity shares surface in listings and mount checks without extra wiring, which is what BA-7491 lands on.

The list filter reuses the own-check query shape (owned_permissions, BA-7593 - its KNOWLEDGE marks the list filter as this follow-up), and the equivalence/benchmark harness in test_own_check_query.py is the cutover verification tool.

Cutover caveat: existing folders have no graph rows until the BA-7571 backfill, so the graph path lands alongside the legacy union and the switch flips after the migration. Coordinate the boundary with BA-7526 (generic graph-based reads) to avoid overlap.

JIRA Issue: BA-7577

Start with the hand-written accessibility union in models/vfolder/row.py and trace its roughly ten call sites, including the mount path and model-serving/deployment repositories. Read test_own_check_query.py and its equivalence/benchmark harness, then review BA-7571 and BA-7526 before defining the cutover boundary. Done means graph-based reads and the RBAC-gated vfolder actions cover listings and mount checks while retaining the legacy path until backfill completes.

Written by the indexing model from the issue text.