Function leaf_is_write_capable 

pub fn leaf_is_write_capable(spec: &LeafSpec) -> bool

A leaf is write-capable when it can mutate the workspace.

Authority comes from the declared mode and permissions, not the agent’s role identity. In particular, an implementer may be deliberately confined to a read-only verification task. Used by workflow lowering to decide the default isolation for parallel children (#4120).