populate member from the authenticated socket

The last mechanical link: chat socket -> resolveMemberRun(userId) ->
ClaudeSpawnStreamingParams.member -> claude-manager's branch ->
spawnClaudeAsMember -> sudo setpriv. The path from a request to a privilege drop
is now complete.

Resolved from the authenticated socket, never from the client message — the same
rule server.tsx applies to the pty sidecar, where it deletes any client-supplied
osUser/home from the query string before setting its own.

resolveMemberRun returns undefined rather than throwing when a home cannot be
resolved, because undefined means "the owner" downstream: an account with no
Linux user has nothing to confine a turn to, and falling back to the owner is
the one wrong answer that must not happen by accident. A separate function with
that reasoning attached rather than an inline ternary.

Still inert. Both gates refuse non-owners before this line is reached, so the
only path that reaches it today returns undefined via isOwner.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/channels/send-claude-code.ts

@@ -40,6 +40,8 @@ type ClaudeCodeStreamingParams = {
   model?: string;
   resumeSessionId?: string;
   durable?: boolean;
+  /** Whose Linux account the turn runs as. Undefined for the owner; resolved by the caller, never a client. */
+  member?: { osUser: string; home: string };
   // Finished turn messages, already committed by the sidecar; `seq` is the cursor id to deliver them under.
   onMessage: (msg: TurnMessage, seq?: number) => void;
 };