Client tagging on canonical writes — every observation carries the client that produced it, and every canonical entity carries the materialized set of clients that can see it

The canonical layer is cross-client by design — a materialized `client_access` array is how each workspace still sees only its own.