feat: add managed agents to channels from profiles

[kalvinnchau]

Stack

Depends on #188 (read-only profile channels). Review against am/profile-agent-channels head 2c546f9fd55609202cff2337cdeac1bad06e3bd6 to isolate admission changes.

What changed

• Offer Add to channel only for exact same-community native-managed agents with a managed session choice and eligible classified channel.
• Recheck native and roster evidence before signed invitation; enforce admission through publisher entry, retain outbox outcome, and promote restored legacy invitations to guarded intent when reused.
• Hide generic Retry for guarded invitations; renew eligibility through the channel or profile.
• Review fixes: membership appearing during a pending admission no longer cancels its gate; saved invitation intents older than the relay’s 15-minute event window fail with explicit membership/Outbox recovery instructions rather than being republished forever. Added regressions for both.

Verification

• Head 5c5756221254fb6c13c13689b88606d5f8ed7d86: production typecheck/build; three focused test files (31/31); source-fixture profile browser journeys in Chromium/WebKit (8/8); pre-push TypeScript, related unit tests (90 files, 1,218 tests) and design-system guards passed locally.
• Native picker-to-relay success, live relay authorization, and durable restart behavior remain unverified. Hosted CI and independent re-review pending; the PR stays draft until those gates are assessed.

Sample screenshot

Kalvin’s supplied example of the tester profile’s Add to channel row, hosted as an uncommitted GitHub attachment; no human photograph. This is an example of the feature, not proof of the final head’s live native-to-relay flow.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested: one P2 recovery defect, detailed inline. A failed native refresh removes the active dialog and hides the result instead of giving the user a recovery path.

Merge criterion: preserve a visible outcome/retry surface when eligibility disappears, without weakening admission checks; cover the transition with notifying stores or the real native controller.

Source-only review of 55165717b9e058a374f20e04d13fcbbbf099517c against stacked base 99e6e936b62e040b297f6c2c68889115a1dbf284, including independent UI/native review and coordinator verification. Existing exact-head CI passed its required gate and both browser engines; Windows native validation was skipped. No local tests or PR code execution. Live native-to-relay authorization, packaged behavior and actual restart recovery remain unverified.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Focused re-review: the prior native-refresh recovery blocker is resolved; no new blocking defects found in the changed paths. The open dialog now retains its failure/retry surface while current eligibility still fences admission. The notifying-store regression covers failure, disabled submission, native recovery and explicit resubmission. One non-blocking documentation clarification is inline; the unchanged ordinary-composer path is not being certified as guarded by this re-review.

Reviewed 9153501f8e618fbd84517fafda95ab918ded9a51 against stacked base 99e6e936b62e040b297f6c2c68889115a1dbf284, focusing on the two-file delta from 55165717b9e058a374f20e04d13fcbbbf099517c and its admission/native-control callers. Source-only review with independent UI/native recovery analysis; no PR code or tests executed. Existing exact-head CI passed its required gate and Chromium/WebKit journeys. Windows native validation was skipped; live native-to-relay authorization, packaged behavior and actual durable restart remain unverified. This is a COMMENTED review, not approval or live acceptance.