feat: agent-to-agent platform on ZeroClaw 0.8.2 — rooms, delegation, A2A ingress

Builds on the v0.8.2 runtime. Four workstreams, all behind the §15 MCP door:

- Group rooms (Phase 1): migration 0026; N-way threads repo with a DM/room
  count-guard; chat.send {room} + room.create/invite/leave tools; RoomMessage
  -> room.message SSE; /api/claw-chat/rooms* APIs; Observer room badge.
- Per-claw door identity: door caller_agent resolves the X-ZeroClaw-Agent
  header (set by the fork) to the specific claw, falling back to roster[0].
- Gated delegation bridge (Phase 3): clawmates__delegate door tool drives a
  sibling via the existing /ws/chat ZeroClawDriveExecutor (not A2A); self-deny,
  per-workspace hourly budget, audit trail, untrusted-banner result. Native
  in-daemon delegation stays off (it would bypass the door).
- A2A tenant ingress (Phase 2): migration 0027 (workspace_a2a + a2a_tokens);
  runtime_provision enable_a2a_server/publish_claw; routes/a2a.rs tenant-aware
  proxy (per-workspace tokens, injected internal bearer, daemon stays internal,
  cards URL-rewritten to the cm-api edge); a2a.invoked taxonomy.

Tests: cm-db room repos, cm-runtime chat tools, door units. sqlx cache updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/cm-runtime/src/events.rs

@@ -38,6 +38,14 @@ pub enum RunEventBody {
         text: String,
         thread_id: String,
     },
+    /// A message posted to an N-way group room (§7.2). `participant_ids` are the
+    /// other active members so the observer can fan the event to each of them.
+    RoomMessage {
+        thread_id: String,
+        subject: String,
+        text: String,
+        participant_ids: Vec<String>,
+    },
     /// A gated action awaits human review (§15): carries the exact preview
     /// of what will execute, surfaced as the approval card (§10).
     ApprovalRequired {
@@ -67,6 +75,7 @@ impl RunEventBody {
             RunEventBody::StepStarted { .. } => "step_started",
             RunEventBody::StepFinished { .. } => "step_finished",
             RunEventBody::AgentMessage { .. } => "agent_message",
+            RunEventBody::RoomMessage { .. } => "room_message",
             RunEventBody::ApprovalRequired { .. } => "approval_required",
             RunEventBody::RunSuspended { .. } => "run_suspended",
             RunEventBody::RunCompleted { .. } => "run_completed",