Fix agent group write privacy, transactions and cancellation

[sudoHG]

Closes #171

Summary

Agent-invisible group targets now freeze like absent names, while the App shows existing-group no-ops or merges with source and target member counts in English and Simplified Chinese.
The approval digest binds full target-member state; commit revalidates it and preserves existing spelling and no-op storage semantics.
App group edits merge within one SQL transaction under the exclusive gate; existing metadata and organization writers retain their transaction-current merges.
Expiry cancellation preserves rename/delete-only approvals, and reserved consumption plus organization serialization prevents cancelled writes from committing.
ADR 0010 and the feature inventory describe the completed behavior.

Diff stat

23 files changed, 484 insertions(+), 86 deletions(-), against base 3d639997801b76873d3f2a8107a1becc026bdada.
Implementation SHA: 95ca1aa2c797f4aeafc29dd4e2b82b56cbaeb5d8.
Final SHA (including the screenshot export entry): f00bf14b3286b41331c9cd27c440793168b0a727.

Tests

• swift build --scratch-path .build-171 -j 4: passed.
• swift test --scratch-path .build-171 -j 4 --filter 'AgentOrganization|AgentGroupTransaction|AgentCredentialMetadataWrite|AgentTextWriteApprovalLifecycle|AgentTextWriteConcurrency|AgentTextWriteCreation|HumanTextCredential|OrganizationApproval|ApprovalStateMachine': 92 passed, 0 failed, 0 skipped (Vault 65, Broker 22, App 5).
• Seven new behavioral tests cover indistinguishable invisible/absent targets, no-op/merge commits, stale target state, deterministic App/agent transaction interleavings, both expiry checks, reserved-commit cancellation, and both languages' card copy. Existing expiry assertions now expect the expiry-specific terminal state.
• Base main CI 37797035911: 1085 executed, 3 skipped, 0 failures. The corresponding selected suites contain 85 tests; this change adds 7. The full suite and desktop flows were not run locally.
• PR CI 37803630258, final head f00bf14: both required jobs passed. build-and-test executed 1092 Swift tests: 1089 passed, 3 skipped, 0 failed, adding 7 tests over the base main run. The skipped entries are the opt-in installed Codex contract, the isolated file-commit crash subprocess entry, and explicit synthetic fixture generation. basic-ui-flows passed 15 required desktop tests and 5 screenshot tests, 0 failed and 0 skipped. Attempt 1 could not acquire a hosted build runner; the coordinator retried only that failed job in attempt 2 at the same head, retaining the successful UI job.
• ScreenshotE2ETests/testOrganizationApprovalScreen() passed. Inspected 16-approval-organization.png and 17-approval-organization-existing-targets.png: the existing-group no-op, source/target totals and not-visible counts are readable, and Approve Organization and Deny remain visible. The CI exporter retained all 17 authored images in the UI artifact.

Checks

• python3 scripts/check_hygiene.py: passed, all violations 0.
• python3 scripts/check_module_deps.py: passed.
• git diff --check: passed.
• python3 -m unittest discover -s Tests/Automation -v: 183 passed, 0 failed, 0 skipped after adding the screenshot export name.
• CI release binary symbol check, optimized cancellation runtime, UI delivery gate, development launcher, hygiene and module dependency steps all passed; CI Automation tests also passed all 183 tests.
• Synthetic values only; runtime delivery, permissions, catalog visibility, protocol version and product identifiers are unchanged.
• Task build directory removed after verifying no open files or task build/test processes; approximately 1.0 GiB reclaimed. No task build/test processes remain; shared testmanagerd processes were left running. Data volume free space at final verification: 111 GiB. No local app, desktop flow or screenshot was launched.

Deviations and questions

The coordinator corrected #171 to treat empty stored groups as catalog-visible and approved extending the existing CI-only organization screenshot fixture and assertions to cover invisible-target no-op and merge rows, plus the new PNG name in the exporter's allowlist; the issue's Scope was updated before those edits. No other deviations.