Isolate scheduled tasks by empNo, aligned with uds-auth workspaces.

Super/fallback admins see all jobs grouped by user folder; admin/user only see their own. Stamp ownership on create, filter HTTP/tools, and prefer the owner's provisioned cwd on fire.

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/tools.js

@@ -12,6 +12,11 @@ import {
   resolveCreateOrigin,
 } from './delivery.js'
 import { resolveCreateAgentPreset } from './preset.js'
+import {
+  assertCanAccessJob,
+  filterJobsForIdentity,
+  UNASSIGNED_OWNER,
+} from './ownership.js'
 
 const JOB_SCHEMA = {
   type: 'object',