Tighten permission and input handling

Expression context isolation, invitation key hashing, and permission boundary hardening.