Grant governed composite-child creation on the agent channel

Problem/Motivation

Composite-child entities (paragraphs) cannot be created over JSON:API at all: the paragraphs module's access handler allows creation only when the request format is HTML (entity-form context) and returns neutral for every API format, which collapses to 403. An MCP agent following the standard create-then-reference flow therefore cannot build paragraph-based pages, even when its policy profile allows writes. This is upstream design, not a defect — standalone creation has no host to derive access from — but the governed agent channel supplies exactly the policy context that is missing.

Proposed resolution

When a request is governed and the resolved policy profile permits writes for the entity type, MCP Sentinel's create-access hook grants (rather than stays neutral on) creation of composite-child entity types — those declaring entity_revision_parent_type_field. Scope is deliberately narrow: non-composite entity types keep their existing neutral/forbidden semantics so core role permissions still decide them; ungoverned traffic is untouched; denied entity types and the write gate still forbid first. A standalone composite child is inert until a host references it, and the referencing host save runs the full governance stack (publish gate, composite redirect, write preconditions).

Acceptance criteria

- A governed request whose profile allows writes can create a paragraph over JSON:API.
- The write gate and denied_entity_types still forbid composite creation when policy says no.
- Ungoverned requests keep the upstream neutral behavior (no change for ordinary traffic).
- Non-composite entity types keep their existing create semantics.
- Kernel tests cover the grant, both denial paths, the ungoverned pass-through, and a non-composite control, exercising the real paragraphs access handler in an API request context.

API changes

McpAccessChecker::checkCreateAccess() learns the composite-child grant; no new configuration.