RTC policy wiring: which agent joins which collaboration room, as whom (tier + author-scoping)

[chubes4]

Child of Extra-Chill/extrachill-network#60 (Agent-as-RTC-peer epic). The EC policy layer for agent-as-RTC-peer. Comes last (after the substrate + agent peer exist).

Goal

Decide and enforce the platform policy for an agent joining a Gutenberg collaboration room as a peer: which agent, which room (postType/post:N on which blog), acting as which user.

Why Roadie owns this

Roadie already holds the policy primitives this needs:

• extrachill_roadie_user_tier() — public/team/admin tier mapping (the one auditable cap→tier seam).
• ECRoadie_PlatformTool::assert_acting_user_allowed() — the act-on-behalf-of gate (writer touches own; admin may target others).
• The writing-assistant tools + author-scoping from feat: Roadie writing assistant — edit + submit your own Studio draft via chat #49 (a writer edits only their own draft on main).

The Gutenberg sync server already enforces current_user_can('edit_post', N) at the transport. Roadie's job is the intent/policy layer above that: a team writer's agent joins their own draft's room as them; an admin's may join others'; public tier never joins. Same model as #49, new channel (live room instead of REST apply).

Scope (once data-machine#2675 + blocks-everywhere#106 land)

• Map Roadie tier + author-scoping → 'agent may join room postType/post:N as user U'.
• Multisite room resolution via #2669's blog_id (writer's draft lives on main; resolve the correct room/blog).
• Lifecycle policy: agent joins a room only for an active writing session / authorized scheduled window; leaves when done (bounds polling cost).
• Guidance updates so the agent knows it's a live collaborator (propose-then-write etiquette in a shared doc, never publish — consistent with feat: Roadie writing assistant — edit + submit your own Studio draft via chat #49).

Acceptance

• A team writer's Roadie can join their own draft's room and edit live; cannot join another writer's room (admins can).
• Public tier never joins a room.
• Cross-site (blog_id) room targeting resolves to the right post/blog.

Layer rule: EC-specific policy lives here; the generic Yjs-peer + sync transport stay in data-machine / Gutenberg. No vendor/policy names leak into the generic layers.

Prereqs: data-machine#2675 (agent peer), Extra-Chill/blocks-everywhere#106 (BE binding), Extra-Chill/extrachill-network#61 (enable). Builds atop #49, #2669.