docs: record why a stale dispatch address cannot escalate

backend/windmill-common/src/users.rs

@@ -235,8 +235,14 @@ pub async fn permissioned_as_from_email(
 /// runnable) is the authority for every run that follows it, so a stale address there is
 /// permanent and invisible: those use [`get_email_from_permissioned_as_uncached`]. Job dispatch
 /// also stores its answer, and the worker reads it back to build that run's authed, but it
-/// governs one job and dies with it — bounded enough to be worth keeping dispatch off the
-/// database, so it stays here.
+/// governs one job and dies with it, so it stays here.
+///
+/// What makes a stale dispatch address harmless is not that bound, though — it is that nothing is
+/// authorized from the address itself. `fetch_authed_from_permissioned_as` re-reads
+/// `password.super_admin` and `email_to_igroup` live, keyed on it, and `change_user_email` moves
+/// both onto the new address, so a stale one matches nothing and grants nothing: the direction is
+/// de-privileging, never escalation. Memoize an `Authed` beside the address, or grant from this
+/// string without that live re-read, and dispatch has to move to the uncached variant.
 ///
 /// Reads through the non-RLS pool and authorizes nothing — callers must already be authorized
 /// for `workspace_id`.