feat(desktop): approve guest Turn requests

[M4n5ter]

English

Summary

Complete the Desktop collaboration loop: a Guest with request authority can submit a Turn request and follow its status, while the Owner can approve or reject pending requests. Local-only Sessions no longer expose a sharing action that cannot produce a reachable Guest connection.

Refs #3843

Verification

• npm --workspace @maka/runtime-host run typecheck
• npm --workspace @maka/desktop run typecheck
• node --test packages/runtime-host/dist/__tests__/session-collaboration-authority.test.js packages/runtime-host/dist/__tests__/session-catalog-protocol.test.js packages/runtime-host/dist/__tests__/authenticated-websocket.test.js (38 passed)
• Real Electron smoke through CDP: created and opened a Local Session and confirmed its unavailable sharing path is not exposed

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex implemented and verified the change under the maintainer's direction and review.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

摘要

完成 Desktop 协作闭环：拥有请求 authority 的 Guest 可提交 Turn 请求并查看状态，Owner 可批准或拒绝待处理请求。仅 Local 的 Session 不再显示无法产生可达 Guest 连接的分享操作。

关联 #3843

验证

• npm --workspace @maka/runtime-host run typecheck
• npm --workspace @maka/desktop run typecheck
• node --test packages/runtime-host/dist/__tests__/session-collaboration-authority.test.js packages/runtime-host/dist/__tests__/session-catalog-protocol.test.js packages/runtime-host/dist/__tests__/authenticated-websocket.test.js（38 项通过）
• 通过 CDP 进行真实 Electron smoke：创建并打开 Local Session，确认不会暴露不可用的分享路径

AI 使用

OpenAI Codex 在维护者的指导和审核下参与了实现与验证。