Dry runs

Operations that reach people, publish or erase accept ?dry_run=true: every check runs — the key, its scopes, the role, the workspace pause, the rules — and the answer says what would happen. Nothing changes and no Idempotency-Key is needed.