Expose ExternalMessageGateway.addCollaborator for authenticated gateways

[PrincipleTechWG]

Channel gateways (Teams, etc.) already authenticate callerEmail for submitExternalMessage, but cannot grant Build to other conversation members who already have accounts.

What

• Add ExternalMessageGateway.addCollaborator({ gadgetKey, username, role, note? }) resolving the Overseer via the same ${source}:${gadgetKey} naming as submit.
• Add OverseerDurableObject.addExternalCollaborator that grants via SharingManager as the workspace owner (there is no browser session / #sharingCaller on this path).
• Returns null when the username has no account (same contract as Overseer addCollaborator). Throws when sharing is prohibited.

Why

Without this, every group-chat participant after the first needs a manual Build share in Workshop. Gateways already have roster → Graph email resolution; only the RPC is missing.

Security

Gateways remain the trusted identity boundary: only pass usernames the gateway has authenticated (never model- or client-supplied identity). Documented on the interface.

Size note

This is a small additive surface on an existing service-binding entrypoint. Happy to trim or reshape if maintainers prefer a sibling entrypoint.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}