[tmfahey]

Summary

• payroll calculate and payroll update now map to payrolls:write, and payroll blockers maps to payrolls:read.
• payrolls:run comes off the login scope list. No CLI command needs it anymore, and it's the scope that submits payroll and funds contractor payments, so a CLI login no longer requests money movement.

Linked issue

None.

Test plan

• bun run test:all passes locally
• Manual run of touched commands works against a local development environment
• --agent and --human output verified where touched

The API now accepts the narrower scopes for calculate and blockers. With a fresh login granted payrolls:read and payrolls:write but not payrolls:run, payroll prepare, update, calculate and blockers all succeeded on a draft, and a raw submit through gusto api came back with a missing-scope error naming payrolls:run.

DCO

• Every commit is signed off (git commit -s) per the DCO