Linked Issue

Closes #1544

This lands one public-runtime hardening item from the adversarial audit: Shared-scope env/secret mutations must require global env:write. Remaining #1544 sub-issues are tracked separately (#1545–#1552).

Summary

Host-wide EnvStorageScope::Shared namespaces are not principal-private storage. The kernel previously treated EnvSet/EnvDelete as self-scoped whenever the caller named themselves, so a builtin self:* agent could write system:control:* secrets that every principal's capsule resolution falls back to.

This change gates Shared-scope env mutations on global env:write. Agent-scoped self writes stay on self:env:write.

Changes

• Resolve EnvSet/EnvDelete with EnvStorageScope::Shared as AuthorityScope::Global, even when principal == caller.
• Keep Agent-scoped env writes self-scoped when the caller targets themselves.
• Add a regression test that builtin agent profiles cannot authorize Shared writes and still can authorize self:env:write.
• Changelog fragment: changes/1544.security.md.

Verification

• cargo fmt --all -- --check
• cargo test -p astrid-kernel --lib shared_env_mutations --locked
• cargo clippy -p astrid-kernel --locked --all-targets -- -D warnings

AI / Tool Assistance

Assisted-by: Cursor Grok 4.6

Cursor drafted the Shared-scope authority gate, the regression test, rustfmt/clippy cleanups, and this PR template. I reviewed that Shared writes require env:write, Agent-scoped self writes remain self:env:write, and the previous dedicated Shared match arm is gone so clippy::match_same_arms does not fire.

Checklist

• Linked to an issue
• Changelog fragment added under changes/1544.security.md
• I understand every change in this PR and can explain its design, risks, and validation.
• I reviewed and tested any meaningful tool-generated output included in this PR.
• Every non-bot, non-merge commit has a matching Signed-off-by trailer.