Fix shared agent mentions

[benclink]

What changed

• Allow bot-role members of the current channel into mention autocomplete even when the current user does not own the agent.
• Keep the existing relay response-policy check as the authority for whether that agent may be invoked.
• Add unit and desktop browser regression coverage for a non-owner mentioning a shared agent configured to respond to anyone.

Root cause

The composer discarded every agent identity outside the current user's managed-agent list before evaluating channel membership and the relay response policy. Shared users therefore saw plain @Agent Name text instead of a resolved mention with the agent pubkey tag.

User impact

Channel members can discover and mention shared agents that are bot members of the channel. Owner-only and allowlist response policies remain enforced by the existing downstream policy gate.

Validation

• just ci
• Focused mention eligibility unit test
• Focused Playwright mention-autocomplete flow

[tonic20]

Reviewed against main HEAD (acfbb1b) — this is the correct, minimal fix for #2349.

The isAgentIdentityMentionable = managed || (isMember && role === "bot") gate admits in-channel bots to the candidate stage while leaving shouldHideAgentFromMentions (and the relay respond-to policy) as the authority, so owner-only / allowlist agents stay enforced downstream. Tracing it through the real eligibility functions for two scenarios:

QUINN (relay-only, allowlist incl. viewer, NON-member) — expected HIDDEN
  #2333: HIDDEN   (preserves the existing "relay-only agents stay hidden ... even when allowlisted" test)
OMAR  (member bot, respond_to anyone, shared channel) — want SHOWN
  #2333: SHOWN

This also preserves the case the alternative #2314 regresses (deleting the pre-filter outright surfaces allowlisted non-member relay agents — details in #2349). And it's the only one of the two with unit + e2e regression coverage.

I also confirmed a live external-Hermes repro that this fixes (in #2349). Looks ready on the merits — could this come out of draft so it can get a maintainer review and merge? Thanks for the clean test coverage.