feat: agent-to-agent platform on ZeroClaw 0.8.2 — rooms, delegation, A2A ingress

Builds on the v0.8.2 runtime. Four workstreams, all behind the §15 MCP door:

- Group rooms (Phase 1): migration 0026; N-way threads repo with a DM/room
  count-guard; chat.send {room} + room.create/invite/leave tools; RoomMessage
  -> room.message SSE; /api/claw-chat/rooms* APIs; Observer room badge.
- Per-claw door identity: door caller_agent resolves the X-ZeroClaw-Agent
  header (set by the fork) to the specific claw, falling back to roster[0].
- Gated delegation bridge (Phase 3): clawmates__delegate door tool drives a
  sibling via the existing /ws/chat ZeroClawDriveExecutor (not A2A); self-deny,
  per-workspace hourly budget, audit trail, untrusted-banner result. Native
  in-daemon delegation stays off (it would bypass the door).
- A2A tenant ingress (Phase 2): migration 0027 (workspace_a2a + a2a_tokens);
  runtime_provision enable_a2a_server/publish_claw; routes/a2a.rs tenant-aware
  proxy (per-workspace tokens, injected internal bearer, daemon stays internal,
  cards URL-rewritten to the cm-api edge); a2a.invoked taxonomy.

Tests: cm-db room repos, cm-runtime chat tools, door units. sqlx cache updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/cm-api/src/routes/world.rs

@@ -152,6 +152,41 @@ fn normalize_run_event(
                 }),
             ));
         }
+        "room_message" => {
+            let s = |k: &str| {
+                payload
+                    .get(k)
+                    .and_then(|v| v.as_str())
+                    .unwrap_or("")
+                    .to_owned()
+            };
+            let participant_ids = payload
+                .get("participant_ids")
+                .and_then(|v| v.as_array())
+                .map(|a| {
+                    a.iter()
+                        .filter_map(|x| x.as_str().map(|s| s.to_owned()))
+                        .collect::<Vec<_>>()
+                })
+                .unwrap_or_default();
+            out.push((
+                "room.message",
+                json!({
+                    "fromAgentId": agent_id,
+                    "threadId": s("thread_id"),
+                    "subject": s("subject"),
+                    "text": s("text"),
+                    "participantIds": participant_ids,
+                }),
+            ));
+        }
+        "a2a_invoked" => {
+            // An external A2A caller started a turn on this agent (a new ingress).
+            out.push((
+                "a2a.invoked",
+                json!({ "agentId": agent_id }),
+            ));
+        }
         _ => {}
     }
     out