Use read-only search_paths for Business Applications discovery

[Rakesh Navale (ranavale)]

Summary

• Route semantic Business Applications discovery through read-only
  search_paths, never do_action("/businessapps/me").
• Keep known environment inventory on direct
  fetch("/businessapps/environments/").
• Follow the live search_paths schema: send the required natural-language
  query or legacy filter, never both.
• Preserve do_action for genuine discovered operations such as environment
  SQL, Custom APIs, app operations, in-app MCP tools, and delegated environment
  work.
• Apply the same contract to workiq and workiq-preview, with a
  domain-owned preview reference that follows the guidance architecture merged
  in docs: reapply WorkIQ guidance from PR #197 #209.
• Add static contract coverage for the exact failure mode, structural
  inventory, provider fan-out, selector rejection, action ownership, and
  denial behavior.

Observed issue this prevents

The previous guidance could funnel a read-only Business Applications intent
first into:

do_action("/businessapps/me")

That is a POST-shaped call. For callers whose effective Work IQ policy denies
POST or mutation-shaped traffic, it can be rejected before any grounded
Business Applications path is returned. The flow then never reaches
search_paths or the appropriate structural fetch.

This PR makes that route an explicit prohibition even when it remains exposed
by the service. Semantic discovery starts with search_paths; environment
inventory goes directly to fetch.

Current routing contract

Intent	First tool
Unknown Business Applications record, app, skill, API, operation, or workflow	search_paths with the one accepted query or filter input
List environments or identify the default environment	fetch("/businessapps/environments/")
Read a known returned resource	fetch on the exact returned path
Inspect an unfamiliar operation or write	get_schema on the exact returned path
Execute environment SQL, Custom API, app operation, in-app MCP tool, or delegated environment work	do_action on the exact discovered path

There is no backend, source, or provider selector. Work IQ searches every
catalog and provider enabled for the current tenant and caller.

Conflict resolution against #209

This branch is rebased onto main at 821949b, which includes #209.

• Preserved docs: reapply WorkIQ guidance from PR #197 #209's condensed, host-neutral workiq-preview skill rather than
  restoring the previous full-document version.
• Added Business Applications as a linked domain reference, matching docs: reapply WorkIQ guidance from PR #197 #209's
  pattern for mail, calendar, files, Teams, and other domains.
• Preserved docs: reapply WorkIQ guidance from PR #197 #209's retrieval/Grounding policy; structured Business
  Applications path discovery remains separate from semantic evidence
  retrieval.
• Updated preview action, search, and troubleshooting references only where
  needed to remove the obsolete discovery route.
• Corrected stable guidance so direct environment inventory no longer
  conflicts with unknown-path discovery.

Validation

• git diff --check
• Reinstalled both affected local plugins after the final edits.
• Full tests/workiq-guidance suite passes.
• Added contract tests that:
  • reject any positive /businessapps/me discovery instruction across either
    plugin, including contradictions hidden in the same paragraph or sentence;
  • require search_paths for semantic Business Applications discovery;
  • require direct fetch("/businessapps/environments/") for environment
    inventory;
  • require automatic fan-out across every enabled catalog/provider and reject
    invented selectors;
  • validate exclusive, nonblank query/legacy-filter examples, including
    malformed, scalar, null, array, and mixed-envelope cases;
  • retain genuine Business Applications do_action categories; and
  • require policy-denied workflows to stop without alternate routing or
    unsupported remediation claims.
• Live hosted Work IQ validation completed previously with a licensed test
  account:
  • natural-language search_paths(filter) returned Business Applications
    paths;
  • fetch("/businessapps/environments/") returned the expected environment
    inventory.
• GitHub Copilot CLI compatibility validation covered required filter,
  required query, and direct environment fetch; discovery traces contained
  no mutation calls.
• Multiple independent reviews completed after conflict resolution; no
  significant issues remain.

Scope and risk

This changes plugin guidance and its validation contracts. It does not modify
the Work IQ service, provider routing, tool schemas, tenant policy, or AppIQ
runtime behavior. Genuine Business Applications actions and writes remain
available and retain normal confirmation, privilege, and policy boundaries.

This PR was prepared and validated with GitHub Copilot CLI.