Allow agents to require an authenticated workspace member caller

Problem In Twenty 2.50, runAgent accepts workspace member sessions, application tokens, and API keys. A run started by an application token or API key can have no authenticated workspace member in its execution context. An agent whose record tools must be bounded by the asking member's role cannot express that requirement in its agent manifest. Prompt instructions are insufficient because the record tools execute under the server's authorization context. Request Please add an opt-in memberOnly (or equivalent) agent setting that refuses a run unless the caller is an authenticated workspace member. An alternative would be a trusted pre-run caller hook that can reject a run before model or record-tool execution. The check should use the server's authenticated caller, not a member id supplied in the prompt or a caller-supplied runAsWorkspaceMemberId. This would let apps enforce a member-role floor for read-only agents while leaving application and API-key runs available…