Run pre-saved Match/CSV Import routines without mapping-config access

To let a coordinator run an import or match routine, you must grant builder-tier access — which also lets them create/edit mappings and can break master setups. Add an execute-only runner: the user picks an authorized CSV and triggers a pre-saved mapping routine, but the field-mapping configuration stays read-only.