Require channel managers for Canvas writes

[joeyblack4]

Summary

• require channel owner or admin role for kind 40100 Canvas writes
• reject blank, oversized, missing-scope, malformed-scope, and multi-channel Canvas events before storage
• cover owner/admin acceptance and member, bot, outsider, malformed, and cross-channel rejection in the full relay E2E suite

Why

A channel Canvas is canonical human-approved context used by every participant and agent in that channel. General channel membership is sufficient to converse, but it should not let every member or bot silently replace canonical context. This keeps publication authority aligned with the existing channel manager roles while leaving Canvas reads unchanged.

Verification

• relay unit tests for Canvas shape and role admission
• full ignored relay E2E proving accepted revisions reach storage and rejected revisions do not
• the same changes passed the downstream 14-gate foundation checkpoint before this clean upstream submission

Scope

This PR changes only relay admission and its E2E coverage. It does not add a context service, change channel membership, change ordinary message writes, or introduce multi-channel Canvas resolution.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 00e61eafa917d296104006576b7a2ddbfd58bb5a...db31019aa4b0264db3285c1a220a828fa116b7fb.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review db31019aa4b0264db3285c1a220a828fa116b7fb to authorize a new review.
Any previous review applies only to its recorded range.

[joeyblack4]

@jmecom @TheSentinel454 could one of you route this relay-admission change to the right reviewer and authorize the required security review for the exact current SHA? The workflow requests this exact comment from a Block organization member:

@buzz-security-review db31019aa4b0264db3285c1a220a828fa116b7fb

The PR is deliberately narrow: one relay admission boundary plus its full E2E matrix. DCO, Semgrep, and zizmor pass; the downstream relay unit and full ignored E2E suites also passed. We need it upstream before the hosted communities.buzz.xyz operator can deploy the same boundary.