Plan 3 of #1303 lifts share ownership to the tenant level, but
RemoveShare / UpdateSharePermission still gated on the original sharer
user. If that user left the tenant or moved on, the source tenant lost
the ability to revoke its own share — only the target org's admin
could clean up, which is governance theatre rather than ownership.
Extend the authz envelope on KB-share and agent-share mutations:
(1) original sharer (unchanged);
(2) source-tenant Admin+ — new, encodes "ownership lives in the
tenant" by reading callerTenantRole from ctx;
(3) target-org admin (unchanged).
Factored out as kbShareService.callerCanManageShare so Update and
Remove cannot drift apart.
wizardchen
f6684f226b