The "Workspace safe forms" setting blocks the forms it lists instead of allowing them

Problem/Motivation

The wse.settings:safe_forms setting is "advertised" as an allowlist, but it does the opposite. WseFormHooks::formAlter() uses it only to skip its own alter, and since that alter runs at Order::Last, skipping it leaves core's validateDefaultWorkspace in place and the listed form is rejected with "This form can only be submitted in the default workspace." Unlisted forms get the submit-to-Live bypass instead, so listing a form makes it strictly less submittable.