Apply transparency tiers and sharing opt-in to threads and plugin usage #205

Closing as completed. Merged to main and pushed as 33114bc (WAL receipt seq 309). The work reused the existing transparency ladder rather than forking one: OpenAgents.Transparency already speaks dark/pulse/ledger/glass, and docs/taxonomy.md already forbids a parallel owner_only/public/unlisted enum, so Thread.visibilities/0 is asserted in a test to be a SUBSET of Transparency.tier_atoms/0 — a fifth word cannot enter through the thread door.

Two rungs are offered because two are enforceable: dark (default, owner-only) and ledger (owner plus any signed-in account holding the thread id). pulse would need a metadata-only projection of a transcript and glass a capability beyond reading one; neither exists, so both are refused with thread_visibility_unsupported. A tier widens READS only — append, cancel, and re-mint still resolve through the owner-scoped lookup, and GrantTokenReachTest now asserts the caller set of each lookup from BEAM import tables so a write that starts resolving through the tier-scoped path fails there. A reader sees the transcript with grant null and no budget card: the ladder discloses the work, not the account's spend. Widening records a thread.visibility_set event in the insert transaction.

The account export already reached threads and events; it now carries repository and visibility, so the consent record leaves with the data it governs. Plugin usage needed no gate today (no aggregate over tool.ran exists), and the requirement is recorded as THREAD-002 for #206: the registry counter must join threads.visibility and count only permitting rows, or it would republish in aggregate what owners kept dark. Also fixed a pre-existing red found in passing: the GET /api/v3/models family was missing from the export inventory classification. 159 targeted tests pass post-merge.