[Team] Verify the real two-human team pilot end to end #58

Planning ID: TODO-M

Proposed issue / PR title: test(team): verify two owners, two Chiefs and an accepted shared task.

Goal: release on product evidence, not only isolated unit tests.

Scope: reproducible real two-user deployment test using separate authenticated clients, Chiefs and private specialists. Cover the complete scenario in Phase 4 and negative routes in the authorization matrix. Add automated integration coverage where practical and a short manual verification checklist for UI-only behavior. Record exact tested commit and which stages ran.

Out of scope: broad load testing, new hardware/CI matrices and social federation.

Dependencies: TODO-E (#50) through TODO-L (#57).

Code area: integration fixtures/test harness, client flow tests and pilot verification documentation.

Acceptance and tests: complete a shared task and explicit acceptance; test concurrent messages, correct-owner approval, cross-owner specialist denial, private marker isolation, mid-task removal, restart/reconnect and cancellation. No skipped safety-critical scenario counts as passing. Existing core and plugin tests remain green, and no test uses live personal credentials or private user data.

Plan update (2026-10-16, team mode via groups): No separate team-mode subsystem is needed; groups with per-Bot grants cover it, and this is step 6 (last) of the ordered plan on #51. It depends on #149, step 2, #55, #56 and #57. Effort: L.

• Gives: in-process two-member tests (room-membership.test.js, signAliceAndBob) and social/face-room tests with a fake context and mock server.
• Gap: no end-to-end flow task -> approval -> result -> acceptance across two owners and two homes; no restart/removal scenarios.
• Harness: core/test/pilot.test.js. First one host with two members (cheap), then a two-host variant using plugins/social/test fakes for FLYBOT-TASK. Cover concurrent posts, correct-owner approval, cross-owner specialist denial, private marker isolation, mid-task removal, restart/reconnect and cancel.
• Manual UI checklist: add a short checklist in docs for UI-only behavior.
• Gate wording: update docs/subsystems/team.md and flip the documented team-mode gate wording only after the pilot passes. No flag is added, as team.md requires.

Delivery

One focused implementation PR for this issue. This is planned work, not a claim of shipped multi-human support. Preserve the pristine upstream pin and generated patch/client boundaries. Keep team mode disabled until the documented authorization gates pass. Record exact tested head, executed checks, missing checks and independent review. No production credentials or live deployment are part of this issue.