system op envelope produces a system cell-origin record

Pin the two invariants every MCP / agent flow silently depends on: every MCP tool requires a wsId to write anything (no implicit "current workspace" on a stateless protocol), and the op envelope's actorClass/agentId are honoured end-to-end into the cell-origins projection. If either breaks, agent tinting, the human-write-protection gate, and the headless server fallback all degrade silently.