fix(mobile): make non-member invitations explicit and cancellable

[loganj]

Summary

• Require an explicit Invite / reference-only choice for people and agents; failures keep the draft instead of silently changing its audience.
• Fence send preparation by account/community, channel/thread visit and draft revision. A→B→A cannot finish an old invitation batch.
• Delay member additions until media upload succeeds; cancelled upload sends no message and adds nobody. Preserve existing member-only background delivery.

Size / stack

574 added + deleted lines including tests. Combines planned lifecycle + invitations into one independent draft, saving one PR. No merge requested.

Evidence

Full mobile package passed at 5b79fe5. Full local just ci was attempted: first run hit an unchanged ACP wire-lifecycle timeout; the rerun was terminated during Rust compilation, so no full-local-CI pass is claimed. The current head’s GitHub Mobile and other executed checks pass (security review is still required). Final cancellation regression proves upload initiation, zero membership events, zero sends and unchanged draft. Dialog tests cover Invite/reference-only/dismiss/refusal. Native simulator unavailable (no Xcode/simctl).

Originating Buzz channel: f6cfbbe2-3f94-4b41-9105-e6dcc5459813.

Composed-stack evidence / landing note

Current review head: 5b79fe52adcc8c892694410b2e96035962d589f2; incremental size: 574 added + deleted lines.

All 11 draft slices are composed on verify/mobile-combined-20260905 at 40630565: just mobile-check and the full just mobile-test pass (2,144 tests). This is integration evidence, not a twelfth review PR or native-device acceptance.

Independent branches overlap, especially in the composer. Use that commit as the conflict-resolution reference when rebasing for landing; do not blindly choose one branch’s send function. Preserve exact/durable bindings, explicit Invite/reference-only intent, visit/account/community/revision fences, and authorization before membership preparation and before publication. Widened discovery must not roll out before #7390 + #7394 are integrated. Code dependency is only the declared PR base; overlapping files and rollout order are not extra dependency edges.

All PRs remain draft; no merge requested. Security/human review is not complete. Originating Buzz channel: f6cfbbe2-3f94-4b41-9105-e6dcc5459813.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 3c7f288c60d67df78577b237e27c3dfc8831aaa1...5b79fe52adcc8c892694410b2e96035962d589f2.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 5b79fe52adcc8c892694410b2e96035962d589f2 to authorize a new review.
Any previous review applies only to its recorded range.