Harden team-mode workspace mutation permissions

[findmikeymike]

Summary

• gate remaining team-mode workspace/session/source mutation paths by role permissions
• protect global source credentials across all workspaces that activate the global source
• guard remote workspace credentials, session model changes, deep-research deletion, and team path override writes
• fix DeepResearchRunner test narrowing so server-core typecheck passes

Validation

• bun run typecheck:all
• focused team-mode/source/deep-research/shared-path tests passed
• git diff --check