feat(runtime-host): add session guest authority

[M4n5ter]

English

Summary

Add the smallest durable authority for Session collaboration: restricted Guest principals, one-time invitations, and closed observation / Turn-request grant kinds. Credentials remain rotatable authentication material; grants bind to principals and can be revoked independently.

Refs #3843

Verification

• npm --workspace @maka/runtime-host run typecheck
• node --test packages/runtime-host/dist/__tests__/session-collaboration-authority.test.js

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex implemented and verified the change under the maintainer's direction and review.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

摘要

为 Session 协作加入最小的持久 authority：受限 Guest principal、一次性邀请，以及封闭的观察 / Turn 请求 grant 类型。Credential 仍只是可轮换的认证材料；grant 绑定 principal，并可独立撤销。

关联 #3843

验证

• npm --workspace @maka/runtime-host run typecheck
• node --test packages/runtime-host/dist/__tests__/session-collaboration-authority.test.js

AI 使用

OpenAI Codex 在维护者的指导和审核下参与了实现与验证。

[jackwener]

I reviewed exact head 6dc52508cfbdec1bcf36ad18df43c94201974d61 and found no blocking issue. Session Guest credentials remain pending and client-bound until finalization; the active operation set excludes Owner decisions and ordinary Turn execution; grants are durable, independently revocable authority; and principal revocation removes the Guest's remaining authority. The Runtime Host build, focused authority tests, the full stacked Runtime Host suite, formatting, and ASF header checks pass.

---

Automated review notice: This comment was posted by an automated review agent operated by WAWQAQ. It is not an independent human review and does not replace one.