feat(platform): share agent chat results via public link (#13081)

### Why / What / How

**Why**: Users in the copilot chat need a public-by-link way to share
useful conversations and the artifacts/runs that make those
conversations understandable. Chat sharing is higher-risk than execution
sharing because chat content can contain pasted secrets, tool payloads,
dispatcher metadata, and workspace file references, so the sanitizer and
allowlists are the security boundary.

**What**: Adds public sharing for `ChatSession`. Owners can enable a
`/share/chat/<uuid>` link from the copilot sidebar, copy it from the
dialog, and see an in-chat "This chat is shared" notice while the link
is live. The public viewer is read-only, stays live while sharing is
enabled, auto-opens the latest shared artifact, uses the logged-in chat
width, and keeps loading/error states centered.

Agent runs are shared at the chat scope, not selected one-by-one. When
the owner includes agent runs, all relevant runs from that chat are
included; changing that share scope requires disabling/re-enabling and
mints a new token so the old link is revoked. Revoking the chat share
cascades only execution shares that originated from the chat link;
user-initiated execution shares survive. Scheduled future executions are
intentionally out of scope for this PR, while actual failed/terminated
runs referenced by the chat can be recovered into the share.

**How**:
- `ChatSession` gets `{isShared, shareToken, sharedAt,
autoShareExecutions}` matching the execution-share token model.
- `SharedChatFile` allowlists files referenced by sanitized shared chat
content.
- `ChatLinkedShare` tracks execution shares owned by the chat share;
`AgentGraphExecution.sharedVia` distinguishes `USER` from `CHAT_LINK`
for cascade revoke.
- `backend/data/sharing/` contains concrete shared helpers for UUID
tokens and workspace/file-reference extraction.
- `backend/copilot/sharing/` owns the sanitizer, live share state, file
allowlists, linked-execution recovery, and cascade revoke behavior.
- Chat share owner routes are gated by `Flag.CHAT_SHARING`; public read
routes remain available so existing links survive a flag rollback.
- Frontend generated API hooks drive the share dialog, owner disclosure,
public chat viewer, linked execution drill-in, and shared artifact
download flow.

### Changes

**Backend**
- Prisma migration for chat share state, shared chat files, linked
execution provenance, and `SharedVia`.
- New chat-share routes in `backend/api/features/chat/share.py`, mounted
from `rest_api.py`.
- Sanitized shared-chat response models that drop credentials/metadata
and redact secret-shaped tool-call args.
- Live linked-execution recovery from `run_agent` messages, including
failed/terminated actual executions.
- Shared artifact/file allowlists split by surface: chat shares expose
files referenced in shared chat content; linked execution shares expose
only public execution output-block files.
- Execution sharing refactored to use the shared token/workspace-ref
helpers.

**Frontend**
- Flag-gated "Share chat" entry in the copilot sidebar.
- Share dialog with live-sharing warning, exposure counts, copy-link
flow, and two-step stop-sharing confirmation.
- Owner-side shared-chat warning above the composer with copy-link
action.
- Public `/share/chat/[token]` read-only viewer with artifact panel and
linked execution navigation.
- Shared viewer polish: latest artifact auto-open, chat width aligned
with the logged-in surface, centered loading state, and faster artifact
downloads through the public file route.

**Tests and validation**
- [x] `poetry run pytest backend/copilot/sharing/db_test.py`
- [x] `poetry run pytest backend/api/features/chat/share_test.py`
- [x] `pnpm exec vitest run
'src/app/(platform)/copilot/tools/RunAgent/components/ExecutionStartedCard/__tests__/titleForStatus.test.ts'`
- [x] `poetry run format`
- [x] `pnpm format`
- [x] `pnpm lint`
- [x] `pnpm types`
- [x] `git diff --check`
- [ ] Manual: enable sharing from the copilot sidebar and confirm the
`/share/chat/<uuid>` link loads in a logged-out/incognito session.
- [ ] Manual: confirm linked executions drill into
`/share/<execution-token>` and chat revocation only revokes `CHAT_LINK`
execution shares.
- [ ] Manual: confirm independently shared executions remain shared
after the chat share is revoked.
- [ ] Manual: confirm secret-shaped chat/tool-call content is redacted
in the public viewer.
- [ ] Manual: toggle `chat-sharing` off and confirm owner POSTs are
blocked while existing public links continue to read.

### Notes for reviewers

- This PR intentionally does not add a generic `Share` abstraction. The
shared module is concrete deduplication; org/workspace sharing work is
the right time to unify share scope concepts.
- The linked execution file fix narrows execution-page downloads to
public output-block files. If a `workspace://...` file is explicitly
referenced in shared chat text, it is still handled by the chat share
file allowlist.
- Scheduled future run re-linking is intentionally out of scope.
Schedule setup messages render as scheduled and are not treated as
completed execution links.
- `poetry run pytest backend/copilot/tools/run_agent_test.py` currently
has three unrelated subscription/paywall expectation failures in the
local setup; the sharing-specific tests above pass.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **High Risk**
> Introduces unauthenticated access to chat content, workspace files,
and linked executions; security depends on sanitization, allowlists, and
cascade-revoke correctness.
> 
> **Overview**
> Adds **public chat sharing** so owners can mint `/share/chat/<token>`
links from copilot, with a read-only viewer, shared header chrome, and
flag-gated enable/disable (`chat-sharing`).
> 
> On the backend, new **owner and public routes** expose share state,
enable/revoke, paginated messages, and allowlisted file downloads
(uniform 404s). A **copilot sharing data layer** builds file allowlists,
optionally auto-links `run_agent` executions (`autoShareExecutions`),
records **`SharedVia` (`USER` vs `CHAT_LINK`)**, and **cascade-revokes**
chat-derived execution shares without touching user-initiated shares.
**Sanitized public models** drop credentials/metadata and redact
secret-shaped tool payloads. **`run_agent`** best-effort auto-links new
runs via DatabaseManager RPC; **chat delete** revokes shares first.
Execution sharing is refactored to shared **token** and **workspace file
reference** helpers.
> 
> Schema adds **`ChatSession` share fields**, **`SharedChatFile`**,
**`ChatLinkedShare`**, and migrations. Frontend adds the **share
dialog**, owner “chat is shared” notice, and **`/share/chat/[token]`**
viewer (artifact panel, linked-run drill-in); execution share pages
reuse **`ShareHeader`**.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
fb18aa6fa556555712bd20aef303dd4aa83f8b17. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>