docs(model-apps): surface probe-persona as an optional post-verify step

`probe-persona.js` shipped in the previous commit with no entry point: no skill
referenced it, so nothing would ever have run it. A script an agent cannot
discover is dead code.

Placed in app-builder Phase 3 (Verify & iterate) rather than folded into verify
itself, because the two answer different questions at different costs and that
separation is the point:

  verify / role-privileges  metadata reconcile. Proves the deployed role HOLDS
                            the declared privileges. Free -- a couple of reads
                            during a verify that is already running -- needs no
                            test user, and is binary, so it belongs in the build
                            gate that already exits non-zero on a partial build.

  probe-persona             runtime authorization. Proves the persona can
                            actually perform the operation, which also depends
                            on ownership, business unit, teams, sharing and
                            plug-ins. Costs N x M round trips, REQUIRES a test
                            principal and prvActOnBehalfOfAnotherUser, and can
                            legitimately return "inconclusive" -- which does not
                            fit a gate that must answer yes or no.

So role-privileges stays where it is: moving it out would restore exactly the
hole this PR closed, where a role row exists, verify reports clean, and nothing
checks what the role grants. The probe is opt-in beside it instead.

The entry documents the prerequisites, that inconclusive results are not passes,
and the scope limit -- authorized data operations, not a working app -- so the
output is not over-read at the point of use rather than only in AGENTS.md.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 42626da2-b66f-4162-acaa-b1127ef23d89

Author: akshay-viz

plugins/model-apps/skills/app-builder/SKILL.md

@@ -308,6 +308,25 @@ forms and sitemap subareas + icons; exits non-zero and lists anything missing):
 node "${PLUGIN_ROOT}/scripts/verify-model-app.js" --env <envUrl> --spec @<working-dir>/app-spec.json
 ```
 
+**Optional — probe what each persona can actually DO.** Verify's `role-privileges` check is a
+*metadata* comparison: it proves the deployed role HOLDS the declared privileges. It cannot prove the
+persona can perform the operation, because that also depends on record ownership, business-unit
+placement, team membership, sharing, and server-side plug-ins. To check that, run real reads **as each
+persona** using Dataverse impersonation (read-only; it changes nothing):
+
+```bash
+node "${PLUGIN_ROOT}/scripts/probe-persona.js" --env <envUrl> --spec @<working-dir>/app-spec.json
+```
+
+It also probes the **negative** direction — reading an entity another persona declares and this one
+does not — which is the only way to catch an over-broad role, since from the inside every operation
+the user tries simply succeeds. Prerequisites (it reports clearly and exits rather than guessing when
+they are unmet): the persona declares `assignTo.users[]`, and the signed-in user holds
+`prvActOnBehalfOfAnotherUser` assigned **directly**. Results marked *inconclusive* proved nothing
+either way and are **not** passes. It exercises the Web API, so a green run means the data operations
+are authorized — **not** that the app works: navigation, form and control visibility, client script
+and layout still need a human or a browser pass.
+
 Then open the app in the browser. Refine `app-spec.json` and re-run Phase 2 to iterate.
 
 **Teardown (cleanup).** To remove everything an App Spec built — e.g. a live-verification probe or a