fix(collab): harden workspace authority recovery and revocation

[lefarcen]

Why

While validating Workspace collaboration end to end, we reproduced three authority gaps on the feat/workspace-team integration branch:

• a member could keep reading an already-materialized Team project after the owner revoked sharing;
• an unbound Personal project could lose settled authority when the ambient Workspace shell changed, leaving the same project opening stuck on a skeleton or viewer-only state;
• app-owned raw requests did not consistently pair explicit Workspace query parameters with the matching headers.

These bugs either retain access after revocation or strand authorized users in a stale fail-closed state. This follow-up keeps Team authorization fail-closed while making revocation and recovery converge deterministically.

What users will see

• After an owner changes a Team project from Workspace-visible to private, members lose access without continuing to see stale files or previews. The local mirror and bytes remain preserved.
• Personal and other unbound projects recover in the same opening after Workspace scope/status resolves, instead of requiring the project to be closed and reopened.
• Scoped raw reads and deletes consistently use the selected Workspace authority; browser-owned iframe, CSS, font, and image navigation remains query-scoped because those navigations cannot attach custom headers.

Surface area

• UI — new page / dialog / panel / menu item / setting / empty state in apps/web or apps/desktop (including Electron menu bar)
• Keyboard shortcut — new or changed
• CLI / env var — new od subcommand or flag, new tools-dev / tools-pack flag, or new OD_* env var
• API / contract — new /api/* endpoint, new SSE event, or changed shape in packages/contracts
• Extension point — new entry under skills/, design-systems/, design-templates/, or craft/, or change to the skills protocol
• i18n keys — added new translation keys (see TRANSLATIONS.md for the locale workflow)
• New top-level dependency — adding any new entry to the root package.json
• Default behavior change — authority revocation and recovery now converge without stale content
• None — internal refactor, docs, tests, or translation update only

Screenshots

No new visual surface. Real two-account Chrome acceptance is tracked separately for the existing project viewer states.

Bug fix verification

• Red specs:
  • apps/daemon/tests/collab/workspace-projects-hub-wiring.test.ts
  • apps/daemon/tests/collab/workspace-projects-reconcile-http.test.ts
  • apps/web/tests/useProjectWorkspaceScope.test.tsx
  • apps/web/tests/useProjectWorkspaceScope.workspace-identity.test.tsx
  • apps/web/tests/components/FileViewer.test.tsx
  • apps/web/tests/components/DesignKitView.test.tsx
  • apps/web/tests/components/ProjectView.run-workspace-identity.test.tsx
  • apps/web/tests/providers/project-workspace-transport-scope.test.ts
• Yes. The new assertions failed on the integration base and pass on this branch. They cover revoke quarantine, same-mount pending-to-authorized recovery, and query/header transport consistency.

Validation

• Daemon focused tests: 40 passed
• Web focused tests: 320 passed
• pnpm --filter @open-design/web typecheck
• pnpm guard
• Each source fix was also validated independently with root pnpm typecheck and git diff --check
• Real two-account Chrome acceptance requested via the team Feishu webhook; results pending