Authorize 3 Agent Execution GraphQL types for fine-grained tokens

Summary

A fine-grained personal access token is denied DuoWorkflowEnablement and DuoWorkflowEnablementCheck: they declare no authorize_granular_token directive and are still listed in config/authz/graphql/authorization_todo.txt, so Project.duoWorkflowStatusCheck gives the token null even when it can read the project. A legacy token can use them.

DuoWorkflowPermissions already skips the token check, because DuoWorkflow checks read_duo_workflow, but it does not declare that permission yet, so the same file still lists it under parent_authorizes:.

As agreed in !267273 (comment 4195231927), I will send this domain's types in one merge request, which closes this issue.

Proposal

• DuoWorkflowEnablement is returned only by Project.duoWorkflowStatusCheck, and DuoWorkflowEnablementCheck only by its checks field, so both declare read_project, the permission Project checks, with parent_authorizes:, with a spec for each parent.
• DuoWorkflowPermissions is returned only by DuoWorkflow.userPermissions, so it declares read_duo_workflow, the permission DuoWorkflow checks. Nothing changes for any token there.

I expect no new permission.

Related to #593878.

I found this while working on gitlab-mcp-server.