Allow Elle to read/write reports scoped to a single non-excluded workspace when AI workspace restrictions are set

What is the challenge?

• When any workspace is excluded from Elle's AI controls, Elle can't read, create, or edit any report account-wide, even if the report only contains data from allowed workspaces.

What is the impact?

• Common setups (excluding test or internal workspaces) block Elle from helping with everyday reporting, even when the actual data in scope is safe. The workaround (telling Elle not to use reports) is inconsistent since Elle often reaches for reports mid-task without being asked, so users hit the error unexpectedly.

Describe your idea.

• Scope the restriction to reports that could actually contain excluded-workspace data, based on the report's real workspace filter, instead of blocking all reports account-wide whenever any workspace is excluded.