Follow-up to #161, stacked on `codex/team-agent-access`. Refs #158 and #5. Implements the requested header UI rather than the details-sidebar checkbox.

- Two independent icon toggle buttons immediately left of the header's **+**: collaborator agent access, then channel desktop tools. Owners can change them; collaborators see their state read-only. Pressed styling, accessible names/states, explanatory tooltips, pending states and error toasts use the shared UI components. The old sidebar sharing section is removed. - Agent access retains #161's behavior: blocks new collaborator invocations, not human chat or active runs. - Desktop access is channel-wide, including owner and collaborator runs, other chats and subagents. It refuses new native desktop dispatch while off, without cancelling already-dispatched operations or restricting shell tools. This is not a shell security sandbox. - SettingsDoc v2 migrates v1 by preserving `shared` and adding `desktop: true`; existing channels keep their behavior. Both settings stream through metadata. Older hosts get an unavailable desktop control instead of an unsupported request.

### Validation

- `bun types`, `bun run ci`, `git diff --check` pass. - Signed lane-local Ace-dev build, real native desktop inspection/clicks: verified agent → monitor → + placement, all four independent toggle combinations, both-off and both-on persistence through full app/host restarts, and absence of the sidebar checkbox. Isolated profile/channel only; development processes stopped afterward. - Real Anthropic runs verified owner/subagent refusal, mid-run disabling in a collaborator's second chat, re-enabled native inventory, and persisted refusal after worker restart. - Reopened two isolated channel backups (absent settings and v1 sharing off); sharing preserved and desktop enabled. All 175 original entries remained byte-for-byte unchanged; integrity checks and source-backup checksums passed. - Not exercised natively: collaborator read-only view, older/disconnected hosts, hover tooltips and split-pane layouts. Hosted forwarding was type/code reviewed, not deployed; no second-person/tailnet-machine check.

### Built in Ace

Entirely built in Ace, using this channel's lane, shell/build tools, subagents and native desktop tools. No external editor, terminal, browser automation or agent was used.

Consolidated into #161 at the user’s request: e3bb405 was fast-forwarded directly onto codex/team-agent-access. GitHub automatically marked this stacked PR merged when its base acquired the commit; it is no longer open. Continue review in #161, which now contains both toggles. Nothing was merged into main.