fix(dag): enforce project isolation for API and summaries

[LeXwDeX]

Description\n\nDAG instance HTTP handlers query the process-wide store without restricting rows to the current instance project. A client attached to project B can enumerate, read, or control workflows owned by project A. DagSummaryPublisher also consumes process-wide events without filtering event location, then emits them under the current instance context.\n\nSeverity: HIGH (release blocker).\n\n## Reproduce\n\n1. Open two project instances backed by the same process.\n2. Create a DAG in project A.\n3. Call the DAG list/detail/control API from project B, or observe summary events in B.\n4. The foreign workflow is visible/control-capable and summary updates can be misrouted.\n\n## Acceptance\n\n- Instance DAG APIs expose and mutate only workflows/sessions owned by the current project.\n- Foreign workflow/session IDs return not found.\n- SummaryPublisher filters durable events by the current directory/workspace before recomputing or emitting.\n- Cross-project regression tests cover reads, controls, starts, and summary events.\n

[LeXwDeX]

已由 PR #148 修复，并通过 PR #149 晋级 main。dev push、main PR、main push 三轮 Typecheck/Unit/Go/生成物/HttpAPI/Linux+Windows E2E/CodeQL 均通过。