[Team] Isolate private context from shared room context #53

Planning ID: TODO-H

Proposed issue / PR title: feat(context): enforce explicit context sharing across owners.

Goal: Chiefs can collaborate without leaking private chats, memory or credentials.

Scope: room-scoped context assembly, authorized references/artifacts and explicit private-to-shared selection. Audit current own-chat brief and shared-memory injection into group sessions. Split personal, owner-team and shared-room memory as needed by the agreed model; prevent a room reference from granting access beyond its source permissions. Route private clarification to the owner.

Out of scope: new retrieval infrastructure or automatic organization-wide knowledge indexing.

Dependencies: TODO-D (#49), TODO-E (#50), TODO-G (#52).

Code area: groups, prompt/context construction, memory, chat references, attachments and file-read authorization.

Acceptance and tests: seed each owner’s private context with unique test markers; another owner’s requests and shared-room context cannot retrieve them without an explicit authorized share. Sharing one artifact does not expose its folder or underlying secrets. Removing access prevents subsequent retrieval and injection; document that previously received messages cannot be retroactively unseen.

Delivery

One focused implementation PR for this issue. This is planned work, not a claim of shipped multi-human support. Preserve the pristine upstream pin and generated patch/client boundaries. Keep team mode disabled until the documented authorization gates pass. Record exact tested head, executed checks, missing checks and independent review. No production credentials or live deployment are part of this issue.