fix(lock): prevent duplicates inside locked containers via regenerateBlockIds

1. regenerateBlockIds now checks if existing parent is locked before
   keeping the block inside it. If parent is locked, the duplicate
   is placed outside (parentId cleared) instead of creating an
   inconsistent state.

2. Remove unnecessary effectivePermissions.canAdmin and potentialParentId
   from onNodeDragStart dependency array.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/workflow.tsx

@@ -2889,14 +2889,7 @@ const WorkflowContent = React.memo(() => {
         }
       })
     },
-    [
-      blocks,
-      setDragStartPosition,
-      getNodes,
-      potentialParentId,
-      setPotentialParentId,
-      effectivePermissions.canAdmin,
-    ]
+    [blocks, setDragStartPosition, getNodes, setPotentialParentId]
   )
 
   /** Handles node drag stop to establish parent-child relationships. */

apps/sim/stores/workflows/utils.ts

@@ -511,14 +511,15 @@ export function regenerateBlockIds(
           parentId: newParentId,
           extent: 'parent',
         }
-      } else if (existingBlockNames[oldParentId]) {
-        // Parent exists in existing workflow - keep original parentId (block stays in same subflow)
+      } else if (existingBlockNames[oldParentId] && !existingBlockNames[oldParentId].locked) {
+        // Parent exists in existing workflow and is not locked - keep original parentId
         block.data = {
           ...block.data,
           parentId: oldParentId,
           extent: 'parent',
         }
       } else {
+        // Parent doesn't exist anywhere OR parent is locked - clear the relationship
         // Parent doesn't exist anywhere - clear the relationship
         block.data = { ...block.data, parentId: undefined, extent: undefined }
       }