fix: publishing a directory takes ownership, not write (PUT-1619) (#3654)

Creating a hosted subdomain gated `root_dir` on `write`, and hosting serves
everything under that directory with the ACL deliberately bypassed. So a
recipient of a `write` share could point a `*.puter.site` subdomain at the
owner's folder and make the subtree world-readable — continuously, covering
files the owner added later, with the row under the recipient's account where
nothing the owner can list would show it. `update` had the same gate for a
changed `root_dir`.

`#checkPublishAccess` now decides both: the actor's own tree still takes
`write`, anyone else's takes `manage` — "Can edit & share", the level that
delegates the decision.

Keyed on who owns the entry rather than asking for `manage` outright, which is
what the ticket proposed. `manage`'s is-owner implicator declines to answer for
app actors, so a flat `manage` would refuse every app publishing a directory
its user handed it, with no way for the app to obtain the grant. The write
check still runs first — it is what masks a directory the caller cannot see as
a 404 — and `manage` satisfies every lower mode, so the order costs a
manage-holder nothing.

The GUI's Publish As Website item reuses the own-it-or-`manage` answer it
already computes for sharing, so it is not offered where this would refuse.
Docs state the rule on `hosting.create()` and in `share()`'s level list.

Regression tests fail without the driver change: a write-share recipient is
refused on create and on repointing an existing subdomain, while `manage` and
the actor's own directory are accepted.

src/gui/src/helpers/generateFileContextMenu.js

@@ -123,7 +123,10 @@ const generate_file_context_menu = async function (options) {
     if ( !is_trashed && !is_trash && fsentry.is_dir ) {
         menu_items.push({
             html: i18n('publish_as_website'),
-            disabled: !fsentry.is_dir || fsentry.has_website,
+            // Publishing serves the folder to anyone, for good, so it takes the
+            // same own-it-or-`manage` right as sharing it does (SubdomainDriver
+            // enforces that). `write` on someone else's folder is not enough.
+            disabled: !fsentry.is_dir || fsentry.has_website || !may_share,
             onClick: async function () {
                 await publish_as_website({
                     uid: fsentry.uid,