Add owner-scoped permissions for full-job routines (#1440)

* docs: add comments explaining CLI_ENABLED=false in service templates (#990)

Clarify that CLI_ENABLED=false is needed in daemon mode (launchd/systemd)
to prevent blocking on stdin when running as a background service.

Closes #990

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* Add owner-scoped full-job routine permissions

* Address PR review feedback

* Fix owner gate test timing

---------

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

src/service.rs

@@ -94,6 +94,7 @@ fn macos_plist_content(exe: &str, stdout: &str, stderr: &str) -> String {
   <true/>
   <key>KeepAlive</key>
   <true/>
+  <!-- Disable interactive CLI/REPL in daemon mode to prevent blocking on stdin -->
   <key>EnvironmentVariables</key>
   <dict>
     <key>CLI_ENABLED</key>
@@ -127,6 +128,7 @@ fn install_linux() -> Result<()> {
          \n\
          [Service]\n\
          Type=simple\n\
+         # Disable interactive CLI/REPL in daemon mode to prevent blocking on stdin\n\
          Environment=\"CLI_ENABLED=false\"\n\
          ExecStart=\"{exe}\" run\n\
          Restart=always\n\