Workspace AI policy and platform-wide percentiles

What changed

• Workspace owners and admins can now choose which AI levels and sandbox agents their team may use. Other options stay visible but locked, and assessments that use them cannot be saved.
• Recruiters no longer set a weight per question, so the same questions under the same AI conditions always score the same way. Once enough candidates across the platform have taken the exact same setup, the candidates table shows where each one ranks among them.
• Published assessments now show which sandbox agents each question grants, and candidates on sandbox questions get a terminal alongside the tests. Recruiting Copilot's approval card now names reused library questions and shows the right cost for each question's AI level.