fix: keep restricted roles from creating a fork through a session move

The move's fork gate checked only the workspace's forking rule. A role
missing a capability would get the default role in a fork it creates, so
the gate also refuses restricted roles, as the workspace picker does.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte

@@ -19,6 +19,7 @@
 	} from '$lib/utils/workspaceHierarchy'
 	import { useForkableWorkspaces } from '$lib/utils/useForkableWorkspaces.svelte'
 	import { canCreateFork } from '$lib/utils/editInFork'
+	import { capabilitiesIn, isRestricted } from '$lib/roleCapabilities'
 	import { forkAccentStyle } from '$lib/utils/forkColor'
 	import { WorkspaceService } from '$lib/gen'
 	import { useSessionReadOnly } from './sessionPermissions.svelte'
@@ -190,6 +191,13 @@
 				? forksOf !== 'admins' &&
 					!rootRulesetsResource.loading &&
 					!rootUserInfoResource.loading &&
+					// A restricted role would get the default role in the fork it creates.
+					!isRestricted(
+						capabilitiesIn(
+							rootUserInfo,
+							$userWorkspaces.find((w) => w.id === forksOf)
+						)
+					) &&
 					(!isRuleActiveInRulesets(rootRulesets, 'DisableWorkspaceForking') ||
 						canUserBypassRuleKindInRulesets(rootRulesets, 'DisableWorkspaceForking', rootUserInfo))
 				: $workspaceStore !== 'admins' &&