Workers Builds: accept account-owned API tokens as the build token (needed for per-Worker scoping)

[dbl-0]

The Workers Builds configuration docs say:

Currently, only user tokens are supported, with account-owned token support coming soon.

Per-Worker scoping ("Specified Workers", from the 2026-09-15 granular Worker permissions changelog) only works on account-owned tokens. That means every Builds token has to keep account-wide Workers Scripts Edit.

Why it matters: in an account with several sites plus one security-sensitive Worker, any site's build token can deploy over that Worker. We've already cut each build token down to the minimum a user token allows: one token per site, Workers Routes and SSL Write on its own zone only, and no KV or R2. The account-wide Scripts Edit is the one permission we can't remove.

Asks:

1. Is there an ETA for account-owned tokens as the Workers Builds build token?
2. Until then, could user tokens be scoped to specific Workers?

Related: the Builds API also requires a user-scoped token ("Account-scoped tokens are not supported"), so it would be good to know whether that changes on the same timeline.