fix(den): honor grants for admin desktop Skills

[reachjalil]

Summary

• remove the administrator visibility bypass from Marketplace capability filtering
• require explicit member, team, or organization-wide grants for desktop/MCP Skill discovery even when the user can administer all Skills in Den
• add an integration test for administrator desktop availability

Why

Den management visibility and desktop availability are different decisions. An administrator must be able to see all Skills in Den while still controlling which Skills OpenWork Desktop exposes for their own identity.

Focused verification

• all 19 Marketplace capability integration tests passed
• Den API TypeScript typecheck passed
• candidate diff check passed

Root cause

filterVisibleRows returned every capability row for administrators before evaluating grants. That Den convenience leaked into the desktop/MCP catalog. The fix removes only that bypass; Den administration remains unchanged.

Delivery budget lineage

• earlier cooks for this objective accumulated $127.61 in conservative controller reservations without a durable candidate
• this exact candidate was recovered by implementing and verifying the bounded fix locally
• local completion used $0 additional Line Cook/provider budget
• reservation totals are not a provider invoice

Review boundary

This is a focused two-file draft and does not change Marketplace CRUD or Den management permissions.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-landing	Ready	Preview, Comment, Open in v0	Jul 26, 2026 1:28pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
openwork-diagnostics	Skipped		Jul 26, 2026 1:28pm

[vercel]

@reachjalil is attempting to deploy a commit to the Different AI Team on Vercel.

A member of the Team first needs to authorize it.

[reachjalil]

CI triage note: the shared OpenWork Linux/macOS suite currently fails on apps/server/src/opencode-plugins/openwork-capabilities-knowledge.test.ts, which expects Settings > Connect while current dev documentation correctly says Settings > OpenWork Connect. I reproduced the same failure locally from the current dev base; this PR does not modify that test or documentation. The focused candidate checks listed in the PR body pass. Vercel authorization contexts are also external project-access gates, not feature test failures.