cell render: a root group's endpoint reference admits readers the producer's visibility refuses #1059

Problem

The cell render admits, as a consumer of an endpoint, every service whose workspace-configuration-dependencies lists a root group that references that endpoint (pkg/gitops/cell.go, endpointConsumers ~469-545). configuredEndpoint (~593-611) checks neither the producer's declared visibility nor its export policy. A private endpoint is meant to be reachable only from its own module, yet any module's service can add the group and get a mesh edge to it.

docs/commands.md already says a root group's ${endpoint:…} "is held to the producer's export boundary exactly as a declared group's is". The run-time resolution applies that, so the render and the runtime disagree.

Concrete case: a private witness endpoint bound for its own module's host through a root group. Any other module that lists the group is admitted by the mesh, and could append entries that the host then records as gaps, which stops it serving.

Ask

In endpointConsumers, apply the producer's visibility and export policy (core's, the same filter the run uses) to configured references. A reader the policy refuses gets no mesh edge, and the render names the refusal, as a declared dependency to that endpoint would be refused.

Refs codefly-dev/module-saas-starter#1067