fix(desktop): allow authorized agent mentions

[pax-k]

Summary

• allow relay-discovered agents into mention autocomplete when the current user is authorized by their respond_to policy
• preserve filtering for unauthorized or stale agent identities
• cover the other-owned, allowlisted channel-member flow through the signed kind-9 event and its recipient p tag

Root cause

The mention candidate pipeline treated local management ownership as a hard prerequisite before evaluating the existing invocation policy. That conflated who manages an agent with who is allowed to call it, so an agent explicitly allowlisted for Pax was hidden unless Pax also owned it.

Testing

• focused autocomplete eligibility unit tests (19 passed)
• focused Playwright mention scenarios (3 passed)
• pnpm check in desktop
• just ci

Fixes #3125

[DrZeshanKhan]

Independent verification: I reproduced the failure mode where a relay-discovered agent authorized for the current user appeared online in the directory but was missing from @ autocomplete because local ownership was treated as an eligibility prerequisite.

I tested this PR's exact branch locally. The complete desktop unit suite passed (3,638 of 3,638), and the focused Playwright scenario passed, including verification of the recipient p tag. The negative authorization coverage continues to keep unauthorized or stale relay agents hidden.

This matches the observed bug and the intended behavior.