Add deployment-wide workspace viewers - #4

Summary

Add a read-only workspace viewer role for identities that should retain access to every artifact without receiving deployment administration authority.

Changes

• Separate deployment owners, workspace viewers, and per-artifact recipients in authorization and UI behavior.
• Bind workspace viewer invitations to durable Lakebed user IDs and apply access to existing and future artifacts.
• Keep --share scoped to additional artifact-specific recipients while workspace viewers retain access.
• Add setup options and configuration for managing workspace viewers.
• Update the README, contributor guidance, security notes, OpenAPI contract, publisher help, and agent skill terminology.