✨ Add hierarchical group parents in 0.9.3

[jrosseel]

Summary

• add hierarchical IAM groups with nullable parents, explicit local/external provenance, and exact Principal/group authorization boundaries
• absorb ✨ Move workspace conversations to WebSocket transport #696 as the socket-only conversation transport, including shared HTTP/WebSocket authentication admission
• absorb ✨ Add Absurd durable-execution foundation #698 as the durable execution and migration work required by the 0.9.3 cutover
• replace the stale 0.9.0 transition with one fail-closed 0.9.0 -> 0.9.3 migration that rejects unreconciled MCP custody before removing legacy columns and enum states
• remove non-functional MCP credential/OAuth activation and resource-share creation surfaces instead of exposing permanent 503 tombstones

Merge order

This PR must merge last. Its branch contains the complete heads of #696 and #698, so those PRs are superseded by this review surface and will be closed after this PR is green.

Validation

• independent correctness and security reviews: PASS
• reaper residue gate: PASS
• comments/docstring gate: PASS
• full affected lint, test, and build: 122 projects, PASS
• OpenCrane: 22 files / 77 tests, PASS
• focused MCP, grants, API spec, frontend adapters, contracts, and UI tests/lints: PASS
• Prisma generation/validation and boundary checks: PASS
• migration, release, deploy, style, module-growth, stack-integrity, and diff contracts: PASS
• generated OpenAPI contracts and website reference refreshed

Live qualification

After GitHub CI is green, the exact PR head will be deployed to the disposable testv4 cluster and the authenticated HTTP/WebSocket journey will be qualified there.

Local limitation

The workstation has no Docker daemon, so the PostgreSQL convergence proof runs in CI and during the testv4 deployment rather than locally.