Release: collaboration, artifacts, assistant access, and ChatKit updates

[tiven-w]

Summary

• add plugin collaboration and artifact capabilities
• upgrade the ChatKit UI and related collaboration/artifact integration
• improve the Assistant sidebar by prioritizing newly created assistants and revealing drag handles on hover
• tighten marketplace access-request review permissions
• allow UserGroup-authorized users to run published Xperts without granting workspace authoring access
• document the Xpert authoring/runtime permission model and add regression coverage

Why

This release brings the latest collaboration and artifact functionality from develop to main, while also closing gaps in the Assistant experience and published-Xpert authorization flow.

The workspace access failure occurred because published-Xpert ACL checks allowed an approved UserGroup member to start an assistant, but downstream runtime code reused workspace authoring/read checks. Runtime calls now use explicit run authorization, while UserGroup grants remain unable to read, edit, or manage the workspace.

Impact

• approved users can execute their authorized published Xperts and load runtime workflows, skills, and connectors
• Xpert editing remains restricted to creator/workspace authoring relationships
• marketplace approval actions are limited to users allowed to manage the target Xpert
• Assistant navigation and ChatKit collaboration workflows receive updated UX

Validation

• targeted server-ai permission/runtime tests: 6 suites, 60 tests passed
• corepack pnpm b:p:server-ai
• Prettier, hardcoded-color, TypeORM column-type, and Git diff checks