Variable SENSITIVE_SCOPESConst

Sensitive scopes — never granted by default; the user opts in at key creation, and execution still passes a confirm on a Pouchy-controlled surface (see companion.confirm_request).