changelog.d/4954-design-reader-contract.md

Rama main · réplica de lectura del repositorio original.

- **Selected Design API and CLI descriptions distinguish shared snapshots from live reads.** Ordinary readers see the shared version and presence; callers with current Edit authority and separately authorized workspace administrators can read the latest canvas. Foreign administrative access is audited, and a read-scoped credential grants no write authority. Runtime behavior is unchanged.