Add bulk RBAC filtering infrastructure so BulkActionProcessor can narrow actions per-entity and report per-validator decisions.