fix(channel): admit stop and kill like ask, and hide @ace from blocked teammates

[iamnbutler]

Fixes #497, fixes #498. Both cover what a collaborator can do when the owner has turned Collaborator agent access off.

#497: stop and kill are admitted like ask

• @ace/channel/protocol: stop and kill now carry an author.
• Channel#handle validates that author and runs it through #mayInvoke, the same admission ask and answer use. A collaborator who can't invoke gets "Only the owner can invoke agents here". The owner, agent authors, and anyone in a shared channel are still admitted.
• Gateway (authored in apps/host/src/gateway.ts): stop and kill always get the verified Tailscale author, even when the client sent none. Peer relays work as they do for ask, because the channel's own host stamps the relaying host's login.
• The app's Stop, ace stop, and host-internal kill (archive, delete, ace kill) send an author. Host-internal kill uses the record's owner.

#498: no @ace for blocked collaborators

• When shared === false and the viewer isn't the owner, the composer offers only Chat mode, with the placeholder "Message the channel". It has no mode toggle and no @ace mention suggestion. A typed "@ace" is sent as plain text with say and never invokes the agent. The Stop button is hidden, since the channel would refuse it now.
• The old "Switch to Chat / Remove @ace" refusal notice and useInvocation are removed, because the composer can no longer reach that state.
• Saved Ace-mode draft: the draft's words are kept and shown as a chat draft, with the @ace mention removed. The stored mode (ace:mode:/channels/<id>) is left alone. When access returns, the composer is back in Ace mode and adds the mention back in front of the same words. I chose this because it loses nothing, never sends anything unasked, and matches the issue's "keep it until access returns". Sending the draft as a message straight away would post text that was written for the agent. Messages withdrawn from the queue come back the same way, without @ace while access is off.

Older peers

• Old app or CLI → new host: the gateway stamps the author on stop and kill, so the owner's own stop keeps working.
• New client → old host: the old channel ignores the extra author, so its behavior doesn't change. The fix applies once that host updates.
• Hosted channels apply it once the channel service is redeployed with this @ace/channel. Until then they behave as before.

Smoke tests (a real worker and anthropic/claude-haiku-4-5, in a throwaway ACE_HOME/project, using a loopback ace serve on port 4199; the channel was deleted afterwards)

• Unshared channel, owner run in progress: a teammate author's stop, kill, and ask were each refused, and the run kept going. After share on, the teammate's stop ended it.
• Through the gateway, an author-less stop (as an older app sends it) was stamped with the owner and stopped the run.
• ace stop and ace kill as the owner still stop the run.
• Not exercised: the composer UI with a real second person.

Built in Ace

No — Claude Code subagent outside Ace, run by the lead during a batch of fixes.