ViKernel's Action-Permission Boundary: What VIDRAFT's 661-Run Internal Test Actually Tells Engineers