fix(security): scope workflow run dispatch and MCP run logs to the token's tags

server/internal/services/workflow_runner.go

@@ -17,12 +17,24 @@ import (
 
 const stepDispatchGrace = 15 * time.Second
 
-func TriggerWorkflow(instanceID, workflowID, actor string) (string, error) {
+// TriggerWorkflow starts a run of workflow workflowID.
+//
+// tokenScope is the acting credential's tag restriction, nil meaning
+// unrestricted. It is threaded down to ResolveTargetsScoped rather than being
+// applied by the caller, because this is the one place a run's target set is
+// decided: a handler that resolved targets itself and then called an unscoped
+// trigger would leave the dispatch reaching further than the readout.
+//
+// A run whose configured targets fall entirely outside the caller's scope
+// resolves to nothing and returns ErrNoTargets — the same answer a workflow
+// targeting no servers at all gives, so an out-of-scope host stays
+// indistinguishable from one that does not exist.
+func TriggerWorkflow(instanceID, workflowID, actor string, tokenScope map[string]string) (string, error) {
 	wf, err := GetWorkflow(instanceID, workflowID)
 	if err != nil {
 		return "", err
 	}
-	targets, err := ResolveTargets(instanceID, wf.TargetServerIDs, wf.TargetTags)
+	targets, err := ResolveTargetsScoped(instanceID, wf.TargetServerIDs, wf.TargetTags, tokenScope)
 	if err != nil {
 		return "", err
 	}