Roles: drop the guard_guests switch and test redirectProposal's guest refusal #2359

Pillar (0) Trust and calm.

Left over from #2333 (it landed after two rounds of review):

1. guard_guests (FORGE_GUARD_GUESTS) exists only so the older suites, which make plain guest accounts and expect them to own things, keep passing (test/helpers/preload.ts sets it off for the whole suite). The direction asks for nothing to toggle. Promote the accounts those suites use to members in their setup (setMember), delete the setting from src/core/capacity.ts, the MCP capacity enum and the preload line, and let lacks in src/core/roles.ts read only the role. Now the suite runs with the guard off everywhere except test/guests.test.ts, so a new act that should be refused can pass every other test unguarded.

1. redirectProposal (src/actions/proposals.ts) refuses a guest before it writes anything, but no test fails if that line is removed. Add one to test/guests.test.ts: a guest redirecting their own pending proposal is refused with NOT_A_MEMBER, and the proposal and the direction issue are unchanged.

1. sweep() still queues a run with no actor for any agent-assigned issue that has never had a run. An issue a guest got assigned before the guard existed can still start a run there. Decide whether the sweep should check the assigner's role, and test it.

Done means: the setting is gone from Settings → Capacity and MCP, bun test passes with guests refused everywhere, and each of the three has a test.

Parked by the crew: the run ended without a pull: declined: This issue depends on pull #2333, and that pull hasn't been merged. The issue says #2333 "landed", but the forge API shows it is still open with mergedAt: null. It comes from scout's fork, branch