feat(runtime-host): add session guest authority

[M4n5ter]

English

Summary

Add the smallest durable authority for Session collaboration: restricted Guest principals, one-time invitations, and closed observation / Turn-request grant kinds. Credentials remain rotatable authentication material; grants bind to principals and can be revoked independently.

Refs #3843

Verification

• npm --workspace @maka/runtime-host run typecheck
• node --test packages/runtime-host/dist/__tests__/session-collaboration-authority.test.js

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex implemented and verified the change under the maintainer's direction and review.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

摘要

为 Session 协作加入最小的持久 authority：受限 Guest principal、一次性邀请，以及封闭的观察 / Turn 请求 grant 类型。Credential 仍只是可轮换的认证材料；grant 绑定 principal，并可独立撤销。

关联 #3843

验证

• npm --workspace @maka/runtime-host run typecheck
• node --test packages/runtime-host/dist/__tests__/session-collaboration-authority.test.js

AI 使用

OpenAI Codex 在维护者的指导和审核下参与了实现与验证。