Separate Session collaboration authority

[yyjeqhc]

Summary

• add explicit session:collaborate authority for Workflow Session mutations
• keep Session list/detail/observe/discussion on runtime:read
• require session:collaborate for post/resolve/complete/replace/withdraw/close, including piggyback session_message_resolution
• require project:write for update_session_context
• preserve stable user/group Workflow Session identity; fix privilege at the scope layer rather than changing authority fingerprints
• explicitly grant the new scope to direct shared-key, pairing/full interactive, project-share, and reviewed hosted-connect ceilings while keeping omitted/empty legacy OAuth defaults from widening automatically

Security boundary

A managed PAT/OAuth token carrying only runtime:read can still observe collaboration state but can no longer inject guidance or mutate retained Session messages. Direct shared-key behavior remains compatible.

Validation

• cargo test --locked -p webcodex --lib auth::scopes::tests -- --nocapture — 22 passed
• focused piggyback/session-message scope tests passed
• cargo test --locked -p webcodex --lib runtime_console_http::tests -- --nocapture — 23 passed
• cargo test --locked -p webcodex-cli — 304 passed
• pairing/project-share/shared-key bridge focused tests passed
• python3 scripts/check_markdown_links.py — 0 missing
• git diff --check

Full CI requested because this changes an authentication/authorization boundary.