#9858 improvement(api): release audit follow-ups for v2 member analytics, workflow access middleware and docs

Summary

• v2 workspace member role change and removal now emit the same workspace_member_role_changed / workspace_member_removed analytics events as the in-app routes (user-credential principals only, matching the other v2 routes)
• Removed the unreachable requireDeployment=true branch from validateWorkflowAccess; every caller already passed false, and the dead branch authenticated API keys without the read-only check
• Moved the workspace-concealment doc comment back onto v2WorkspaceErrorPolicies and inlined the busy-error predicate
• GitLab permissions CI recipe now says the key needs Full access (a read-only key can read the revision but the CSV replace returns 403)

Type of Change

• Improvement

Testing

• app/api/workflows, app/api/resume, app/api/v2/workspaces, lib/workspaces/api suites (172 tests) and bun run lint; type-check and audits run in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)