[Feat] Block shared publishing from private Sessions

[roomote-roomote]

​Opened on behalf of @daniel-lxs. Follow up by mentioning @roomote-roomote, in the web UI, or in Telegram.

What changed

• Limit private Sessions to Brain reads and explicitly private integrations; block artifacts, wakeups, PR review, external communication, automations, and custom-skill mutation.
• Suppress external notifications and reject source-control writes with an explicit read allowlist.
• Mark proxy credentials read-only and reject Git receive-pack; fail bootstrap if a provider would expose a raw write token.

Why this change was made

Private content must not escape through shared channels, source control, schedules, artifacts, or deployment settings.

Impact

Shared egress remains unchanged. Private delegation reads repositories only where a genuinely read-only credential path exists.

Related PRs

• #2635 — Private Session access foundation
• #2637 — Shared Brain exclusion
• #2638 — Privacy inheritance
• #2640 — Private integration binding
• #2643 — Lifecycle and creation UI

[roomote-community]

2 issues outstanding. See task

• packages/sdk/src/server/lib/task-runs/dequeue-helpers.ts:802 throws private credential failures after claiming the run, leaving raw-token-provider private tasks stuck active instead of settling as canceled.
• packages/sdk/src/server/lib/task-runs/dequeue-helpers.ts:795 mints GitLab write-capable project tokens before failing the read-only check, leaving their descriptors unavailable for revocation.

_{Reviewed a8d5b99}

[roomote-community]

The read-only check runs only after all provider credentials have been minted. With a PAT-backed GitLab connection, createTaskRunScopedGitLabTokens creates one-day Developer project tokens with write_repository; this branch then throws without persisting their descriptors, so the normal cleanup path cannot revoke them. Decide read-only support before minting, or revoke the newly created descriptors before failing.

[roomote-community]

The new private-task failure is thrown after the run has been claimed, but neither dequeueTaskRun nor dequeueResumeTaskRun catches it to cancel and release that run. The worker receives a rejected dequeue response before it has a taskRun to settle, so every private task using a raw-token provider (including GitHub) can remain stuck active/claimed instead of failing closed visibly. Return or handle a classified bootstrap failure here so the dequeue paths execute their existing cancellation flow.