Fix private networks API contract review issues

[rowan-stein]

Context

PR #150 implemented the first private networks/groups API contract slice and was merged before Noa's requested-changes review was applied.

• Original issue: Add private networks and groups API contracts #149
• Merged PR: feat(api): add private networks contracts #150
• Review requesting changes: Noa review on PR feat(api): add private networks contracts #150

Because PR #150 is merged, these requested changes must be handled in a follow-up PR.

Scope

Address the blocking review issues from Noa's review of PR #150:

1. Add missing organization scoping for ListMemberGroups.
2. Add missing provisioning_state to PrivateResourceAccess if not already present on main after merge.
3. Resolve ambiguous proto3 presence semantics for repeated/map fields in update requests.
4. Document or fix the field-number gap in CreateRunnerIdentityRequest.

Requirements

• Keep this PR contract-only.
• Do not implement services, Gateway handlers, DB migrations, NATS deployment, or OpenFGA changes.
• Preserve backwards compatibility where possible.
• Follow existing proto package/go_package conventions.
• Keep architecture alignment with agynio/architecture@2b51477.

Acceptance criteria

• All Noa review comments from PR feat(api): add private networks contracts #150 are addressed.
• buf lint passes.
• Buf breaking check against origin/main passes.
• git diff --check passes.
• Noa re-reviews and approves the follow-up PR.