Hold resumed turns and public-link visitors to the right wiki rules

A paused turn is found by the agent owner's id, so anyone holding one of
the owner's agent keys could resume the owner's own chat with its saved
wiki edit rights. A resume now counts as an API or widget caller when
either the saved state or the resuming request is one, cuts the wiki tool
to wiki_view unless the wiki allows outside edits, and gives the tool
executor the same flags. A request that names an agent, by key or id, may
only resume that agent's turn; otherwise the claim is released and the
request refused.

Public-link visitors run as themselves and reach only wikis they may edit,
so the wiki switch no longer applies to them. Instead every wiki write in
a public-link run waits for the visitor's approval, so the agent owner's
prompt or sources can't steer an edit to the visitor's wiki unasked.

docsgpt/alembic/versions/0043_wiki_outside_edits.py

@@ -1,9 +1,8 @@
-"""0043 wiki outside edits — the wiki owner's say on API, widget and public-link edits.
+"""0043 wiki outside edits — the wiki owner's say on API and widget edits.
 
-An agent run from its API key or widget acts as the agent's owner, and a
-public-link user is a stranger to them, so neither should rewrite a wiki the
-agent can edit unless the wiki's owner allows it. ``wiki_outside_edits``
-records that choice on the source; it is off by default, so such runs can
+An agent run from its API key or widget acts as the agent's owner, so it
+could rewrite any wiki the owner can edit. ``wiki_outside_edits`` records
+whether the wiki's owner allows that; it is off by default, so such runs can
 still read the wiki but not change it.
 
 Idempotent both ways.