feat(permission-groups): declare a capability on the unified selector operation

selectors.execute is exempt with its reason on record: credential access is
authorized per credential, and per-integration denial is the parameterized
allowedIntegrations key, enforced at workflow save and execution. Gating the
picker itself needs a selector-key-to-block-type mapping — a follow-up, not
something to claim silently here.

Author: waleedlatif1

apps/sim/lib/selectors/application/operations.ts

@@ -1,10 +1,12 @@
 import { defineWorkspaceOperation } from '@/lib/core/application'
 
 export const selectorOperations = {
+  // permission-group-exempt: no static capability names selector browsing — credential access is authorized per credential, and per-integration denial is the parameterized allowedIntegrations key, enforced today at workflow save and execution. Gating the picker itself needs a selector-key-to-block-type mapping and is tracked as a follow-up, not silently covered here.
   execute: defineWorkspaceOperation({
     id: 'selectors.execute',
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     principalKinds: ['session'],
+    capability: 'none',
   }),
 } as const