* feat(ui): add shared media lightbox with zoom controls

* fix(ui): share file viewer trackpad zoom with lightbox

…t reads (#7847)

* fix(executor): load permission config once per run and retry transient reads

Every block ran on a shallow copy of the execution context, so the permission-config memo written onto it was discarded and the full permission-group config reloaded from the database before every block. That per-block load had no retry, so a single transient database error failed the whole run, and the raw query error (SQL and bound parameters) surfaced as the block error.

- Memoize the in-flight load in a run-scoped map shared by every block copy, keyed by governed subject and workspace; failed loads are evicted
- Move the bounded transient-read retry from the tool-only wrapper into the shared loader so block, model, agent and tool gates all get it
- Replace a database query error's message in the block error handler and log only its redacted cause
- Redact bound parameters in the execution failure cause log

* fix(executor): honor caller cancellation in unshared permission loads

…tandalone settings surfaces (#7849)

* fix(organizations): seed the server deployment shape on the organization surface

* chore(organizations): describe organization-surface deployment shape seeding

* improvement(settings): carry the deployment shape on the organization context and seed standalone settings

…he grants (#7850)

- Seed largeValueKeys/fileKeys in createExecutionContext so keys a block records on its per-block context copy reach later blocks; child executors get their own lists, never the parent's
- Share one exact-key grant predicate between the async storage check and the sync large-value cache, which previously honored a granted key without checking the key's workspace and workflow
- Correct the executionFilesById TSDoc: the index is built per block from block states

…7851)

* feat(providers): refresh model catalogs and support custom routing

* fix(providers): add verified Qwen 3.8 release dates

…7852)