fix(relay): enforce connected-client ownership before command dispatch

[wolfy-j]

Defect

During websocket connection transfer, a command reaching central can be forwarded to every user hub. Previously, those hubs accepted ws.message without checking sender membership, allowing a plugin to run under another user's actor and grants.

Fix and compatibility

Reject an unconnected sender before JSON decoding or plugin resolution, using the hub's existing connected_clients map. Preserve #165's payload validation, route cache, idempotent JOIN handling and restored membership count. Normal joined-client IDs, payloads and snapshot storage remain unchanged. Commands before JOIN, after LEAVE or from a foreign connection are intentionally rejected.

The documentation now states the welcome/readiness boundary and existing live-update options. No process.set_options field is introduced: central and user hubs already use trap_links=true and upgradable=true.

Tests

• Real two-user actor/permission/persisted-write regression, including early messages, foreign-hub sends, disconnected clients and legitimate own-user commands.
• Real registry-driven live update with the native process.upgrade path. Verify unchanged hub PID and actor, retained client and plugin PIDs, all 32 queued commands, existing process options, and rejection of a foreign sender after upgrade.
• All 36 relay/relay-runtime cases pass on the locally built companion runtime. Original relay dependency lock retained; unrelated Terminal bump and lockrefresh target removed.
• Lua lint passes. Removing the ownership guard makes the isolation regression fail; the unguarded live-update negative control also fails with a hub error, rather than being claimed as a successful assertion of foreign dispatch.

Companion runtime fix

The native transport must preserve JOIN-before-command and command-before-LEAVE ordering. Runtime PR wippyai/runtime#964 provides that ordering without host configuration or process-option changes. Deploy that fix before rolling out this relay module.

This head merges current master to resolve the #165 conflicts. CI and Rodrigo review are still required; nothing has been released.