Make shared Default membership reconciliation atomic - #46

Outcome

• recheck every authenticated direct/group identity under the same ProjectLock used to create the baseline membership
• prevent a concurrent administrator role assignment from being weakened by a later member grant
• preserve shared, personal, none, invalid-mode, and legacy-disabled provisioning semantics
• bump Engine to 0.183.319

Verification

• focused Maven reactor: 17 passed, 0 failed
• deterministic barrier race: 100 iterations
• PastureStack source gate: PASS

The consuming Server release must still pass exact-set v1/v2 direct-user and group permission matrices on QA 8080 before publication.