Ask before an editor's resource runs with their access in someone else's agent

Sponsoring a tool, source or prompt the agent's owner can't use now takes
owning it or having edit access to it; use access alone no longer extends it
to the agent's audience. A save that would make the caller a new sponsor is
refused with 409 sponsor_confirmation_required (the resources and the
agent's audience) until it is retried with confirm_sponsor listing them.
When a sponsor loses access, the resource stops instead of passing to
whoever saves next; another editor takes it over only by confirming.
Workflows follow the same rules. sponsor_details now reports each
sponsorship's state, the reason it stopped, and whether the reader can
take it over.

docsgpt/services/search_service.py

@@ -65,7 +65,8 @@ def _authorized_source_ids(conn, agent: Dict[str, Any], source_ids: List[str]) -
         source_ids: Ids extracted from that row.
 
     A source the owner can't read still searches while the editor who
-    attached it (its sponsor) can edit the agent and read the source.
+    attached it (its sponsor) can edit the agent and still owns or edits
+    the source.
 
     Returns:
         list: The subset the agent's owner (or a live sponsor) may read.