DL-633

Every agent forge read, old and new, runs the same requireForgeScope check as a write and answers not_found outside the agent’s grants, so moving reads from the brokered token to the Server’s installation token keeps the reach gh had

Status: Active (designer proposal, pending Matt, 2026-10-19)