diagram sharing phase 4: public / link sharing with anonymous tickets

[fabracht]

Phase 4 of diagram sharing (design: docs/design/diagram-sharing.md). Phase 1 (#76) supports only named-user grants.

Scope

• _public grant on a resource (view or edit) enabling link-based access.
• Anonymous access ticket for unauthenticated link recipients.
• check_access honors _public grants (its signature was shaped in phase 1 to extend here without a rewrite).
• Topic/event scoping for anonymous recipients (depends on phase 3).
• Agent path first; cluster path tracked in cluster parity for diagram sharing #75.

References

• Design: docs/design/diagram-sharing.md
• TLA: specs/DiagramSharing.tla (InvAnonPublicReceives)
• Phase 1: add agent-mode diagram sharing #76 · Cluster parity: cluster parity for diagram sharing #75 · Depends on phase 3