fix(invite): refuse the host owner's own account joining as a guest

[panghy]

Stack order — 19/22 of the intentd multiplayer stack. Base: #1969 (chore/remove-invite-redeem) · Next: #1988 (feat/invite-reusable-links).
Review only this PR's own commits (chore/remove-invite-redeem..fix/invite-owner-self-join); everything below is reviewed in its own PR.
Merge intent: the stack lands bottom-up in chain order through the merge queue, one PR at a time — this PR merges only after #1969 has landed. The whole intentd stack merges before the cloudlands-fe multiplayer stack (protocol rule: daemon side first); the cloudlands-fe stack must not be merged, auto-merge-armed, or queued until the intentd stack is merged.

Root cause

A guest whose GitHub account is the same account as the host owner's joined
via invite → gist proof. complete_invite_join resolved the proven
github_user_id to the existing primary principal row (is_primary = 1) and
minted a per-principal credential for it. The guest window's /ws connection
then authenticated as the primary: gated_collaborator_caller narrows only
non-administrator Wire callers to their memberships, and the primary owns
every workspace it created — so workspace.list returned every workspace on
the host with myRole: "owner" and the owner-only actions were offered.

Fix

• InviteErrorKind::OwnerSelfJoin — wire error.data.code owner-self-join
  (-32602), message "the host owner cannot join its own host as a guest".
• invite.prove / invite.accept refuse as soon as the identity is known
  (at prove: right after the gist proof resolves the account; at accept: when
  the presented credential's principal is the primary). No credential is minted,
  the invite stays open.
• Store: join_workspace_by_invite guards the same invariant inside the
  transaction (InviteJoinOutcome::OwnerSelfJoin), so the is_primary row can
  never receive a principal_credential row through a join.
• Docs: WorkspaceApi::invite_prove / invite_accept trait docs and the
  protocol.rs catalog module doc name the new kind.

Tests (commit 86a51bf1)

• intent-store tests.rs: join_workspace_by_invite with the primary's
  identity answers OwnerSelfJoin, principal count unchanged, no credential row.
• intent-services invite_ops/tests.rs: prove and accept with the owner's
  github_user_id answer owner-self-join; no principal_credential row.
• intentd e2e_wss_invite_join.rs (real WSS): the owner's own gist proof on
  a pinned invite is -32602 / owner-self-join with no result; the invite
  remains open and the pinned guest joins it afterwards.
• Existing capability::tests::visibility_by_role already asserts a
  collaborator Wire caller sees only its member workspaces on workspace.list.

Gates

cargo fmt --check, cargo clippy --workspace --all-targets -D warnings,
scoped nextest (117 passed: store/services/transport invite + capability),
e2e_wss_invite_join (8 passed), source lints (92 passed).

Protocol docs

docs/protocol/ in the monorepo does not enumerate InviteErrorKind codes as a
table; the catalog module doc in protocol.rs is updated here. If the monorepo
docs/protocol/methods invite section should list owner-self-join, that is a
follow-up monorepo docs PR.

[augmentcode]

^{Deep Code Review Agent🐛}

Review completed with 0 suggestions.

_{Reviewed commit: a85aabc}

[augmentcode]

🤖 Augment PR Summary

Summary: This PR prevents a host owner from joining their own host through a guest invite.

Changes:

• Adds the OwnerSelfJoin invite error and the owner-self-join wire code.
• Maps the new error to JSON-RPC invalid-params (-32602).
• Rejects primary-principal credentials during invite.accept.
• Rejects a proven primary GitHub account during invite.prove.
• Adds a transaction-level store guard before credentials, memberships, or invite redemption are written.
• Propagates the new store outcome through the service layer.
• Updates API and protocol catalog documentation for the new failure mode.
• Adds store, service, and real-WSS coverage for the owner self-join path.

Technical notes: The invite remains open after refusal, and the guard is intended to ensure the primary principal never receives a guest credential.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 2 suggestions posted.

Comment augment review to trigger a new review at any time.