fix(collab): hull-patch part 2 — owner-rotation lockout + keyless-add + import-tolerance (#265)

[cuttlefisch]

Hull-patch part 2 — the three daemon-security bugs (#265)

The daemon-security bugs deferred from the pre-dogfood review (#188), each done in a careful pass with the owner-rotation one adversarially tested. Dogfood is hub-scoped, so these are the hub-relevant correctness/security fixes.

1. Owner rotation → self-lockout on an un-anchored (owned/hub) KB 🔴 (fixed + tested)

The rotation-successor → member_roles mirror ran only on the member self-service branch; the owner (Manage = Allow) left rebind_pairs empty, so after the documented rotate→reconnect the owner got role_of(new_fp) = None → Deny on their own KB.
Added owner_self_rebind_pairs: extracts only the authenticated principal's own self-Rebinds (author == principal, self-signed, fresh successor bound to its key) and mirrors them, inheriting the caller's role. It deliberately does not reuse verify_member_self_service_update (the owner's rotation update also carries E2E content-key re-wraps, which that strict gate rejects), and it cannot inject an arbitrary member (the predecessor is always the caller). The branch is refactored to a clean match expression.

• owner_self_rebind_is_mirrored_into_the_roster_no_lockout — the fix (successor inherits Owner).
• owner_path_does_not_mirror_a_rebind_authored_by_another_principal — adversarial (a Rebind authored by a different principal yields no pair for a non-author caller).

2. Keyless add on an E2E KB 🟠 (fixed)

Adding a member by fingerprint to an encrypted KB can't wrap the content key (no published wrap key to seal to), so they were admitted keyless with success UX. The add now emits a prominent warning steering to :kb-join → :kb-approve (which seals the key); the add still proceeds so they can be re-keyed on a later approve. Advisory sits at the authoritative point (the network task holds content_keys); it's UX defense-in-depth, not a gate, so no network-loop unit test.

3. Import silently became an unpersisted in-memory KB 🟠 (fixed)

import_org_dir_to_store ?-aborted on the first bad node (partial persistent state) and the editor silently swapped to an in-memory copy that vanished on restart. Now per-node error-tolerant (records into report.errors, continues; tracks a node only once it persisted), and a catastrophic store failure surfaces a prominent message-log ERROR instead of a silent ephemeral swap.

Verification

daemon lib 144 + mae-core 2349 + mae-kb 217 green; workspace clippy --all-targets clean (both workspaces).

Deferred (follow-ups on #265)

The links:by_dst index (perf — needs a covering Cozo-index rewrite of links_to, not security) and the heavier tests (≥3-member convergence, recovery-on-anchored, leaked-recovery-supersede, offline-across-rotation) — e2e-harness + membership-fixture work kept separate from the security fixes.