Structured state read access.

agent has read access to the project's structured state stores: application database, infrastructure-as-code state (Terraform/Pulumi/Cloudflare config), and equivalent backends. Scores *capability and usability*; PII masking and IAM scoping are scored under `PL4-least-privilege` / `PL4-pii-masking`