Redesign the global agent-controls table for per-tenant scoping

[JSONbored]

Problem: A global agent-controls table applies across every repository in one deployment today — correct for "one operator, many repos," but it would leak across customers if the same backend hosted more than one customer.

Area: ORB / Cloud

Proposal: Redesign the table (and its consuming code paths) to be scoped per tenant rather than a single global row.

Deliverables:

• Tenant-scoped agent controls, with a migration path for existing self-host deployments (which should continue to behave as one implicit tenant).

Acceptance criteria:

• A change made under one tenant's agent controls has zero effect on another tenant.

[linear-code]

JSO-3545