Scope-guard false positives: symlink targets, create_intent files, and in-task-authored pages flagged ACTIVE_WP_SCOPE_VIOLATION

`ACTIVE_WP_SCOPE_VIOLATION` warnings fire repeatedly for **legitimate** edits during implementation:

- **Symlink not resolved.** A WP owning `CLAUDE.md` edits the real file `AGENTS.md` (`CLAUDE.md` is a symlink → `AGENTS.md`). The scope-guard compares against the literal `owned_files` entry and flags the symlink target as out-of-scope.
- **`create_intent` not consulted.** New files declared in a WP's `create_intent` (not `owned_files`) are flagged as unowned when first written.
- **Pages authored *during* a task can't be pre-declared.** A WP that authors N files inherent to the task can't list them in `owned_files` before they exist, so every one warns.

**Fix direction:** scope-guard should resolve symlinks, union `owned_files` with `create_intent`, and treat `authoritative_surface`-prefixed new files as in-scope.

---
_Split from #3454 (mission-workflow ergonomics cluster surfaced running mission `self-documenting-repo` #3448). See that umbrella for the full evidence set._

Start by locating the scope-guard entry point and its existing tests, then trace how it compares owned_files with changed paths. Verify symlink resolution, the union with create_intent, and authoritative_surface-prefixed new files; done means legitimate edits no longer emit ACTIVE_WP_SCOPE_VIOLATION while unrelated paths still do.

Written by the indexing model from the issue text.