fix(site): include owner context in Agents org picker permission check - #28076

Fixes the Agents org picker and workspace attach menu for users whose only chat grant comes from the member-scoped "Coder Agents User" (agents-access) org role (PRODUCT-552).

Problem

The per-org authcheck behind the org picker checked chat:create with only organization_id. The agents-access role grants chat permissions at org-member scope, which requires the checked object to be owned by the caller (policy.rego org_member requires a non-empty owner matching the subject). With no owner_id, every org check returned false, so:

• the org picker never rendered (permittedOrgs.length > 1 gate),
• the form stayed pinned to the default org,
• the workspace attach menu, filtered to that org, showed "No workspaces found" even though the user had workspaces in another org.

The page-level createChat check already includes owner_id: "me", which is why the same user could load the page and create chats via the API.

Fix

Pass owner_id: "me" in the permittedOrganizations seed check in AgentCreateForm, matching the page-level check's semantics. The permittedOrganizations helper spreads the check object through, so each per-org check now carries owner context and the backend substitutes the caller's user ID.

The other permittedOrganizations callsites (organization_member:create, template:create) check org-scoped admin permissions and correctly omit owner_id.

Adds a regression story whose checkAuthorization mock only allows checks carrying owner_id: "me" (mirroring the RBAC member-scope behavior); it fails without the fix and passes with it (red-green verified).

Validation

• Red-green verified regression story: fails without the fix (picker not found), passes with it; all 31 stories in the file pass.
• pnpm -C site check and pnpm -C site lint:types clean.
• Remote dogfood UAT (dev.coder.com chat 97be7f39): PASS on all acceptance criteria at this exact commit. Reproduced the bug scenario end to end (two orgs, non-admin user with only the "Coder Agents User" role in both, workspace only in the second org): the org picker renders, the second org's workspaces appear in the attach menu, and chat creation succeeds with a real model. Single-org and admin behaviors unchanged. Authcheck probe documents the backend semantics: chat:create with owner_id: "me" returns true, without it returns false.

Mux acted on Mike's behalf for this PR.