Lint rule: external role with write access on state attributes or owner associations #268

The idea:
A lint rule that flags an external user role (a supplier, partner, customer or operator portal role, named per project) with entity write access on a workflow-state attribute or an owner association.

Today:

• CONV006 reports only CREATE and DELETE rights.
• CONV007 (info) reports a missing XPath.
• SEC00x covers app-level settings and PII reads.

None of them looks at member-level write by an external role. grant create, read *, write * … to Supplier where [owner = CurrentUser] passes every enabled rule. Yet it lets that role set its own record's State/Status/Result through the client API, bypassing the microflow that is supposed to be the only way to change it (an approval or review step only internal roles may run). It also lets the role re-point the owner or parent association.

Proposed rule (SEC0xx, security, warning; the toolkit gate's security tier):

• Config: the external roles, as get_option("external_roles", ()) or a project file. If none are configured, emit a _rule blindness finding, never a silent pass.
• Flag when an access rule for an external role grants write on:
  • all members (write *),
  • an enumeration attribute named State, Status, Result, Stage or Phase (list configurable),
  • a *At/*By audit attribute, or
  • an association whose path the rule's own XPath uses for ownership.
• One finding per entity × role, listing the members.
• Message points at the fix: split the grant into read-all, plus create and write of only the input members, gated on the initial state in XPath.

Why this belongs in the toolkit:
External-facing roles are a standard pattern (supplier portals, customer self-service). The defect is invisible to mx check, mxbuild, CONV006 and e2e journeys that test read isolation only. Nearest backlog row: process/lint-backlog.md #14 (anonymous role writes members), which covers the anonymous role but not a named external one.

Field evidence:
A toolkit-built supplier-collaboration app, mxcli v0.25.0, 2026-10-07:

• The supplier role got create, read *, write * on two supplier-owned entities that carry a state attribute. The microflows set that state server-side.
• Lint flagged only CONV006 (create), +4. That rise was re-baselined as "supplier creates its own rows by design", citing a journey that proved read isolation only.
• Found five days later by a manual security review, not by any instrument.

Rough size: one .star rule, a fixture case in tests/lint-rules/, and a README row.