Artifact repository permission isolation: users, groups, and department ACL

Isolate business units on AngusRepo (repo.anguskit.com): shared PROXY, split HOSTED, GROUP members that don’t cross orgs; user/group/department ACL and Deploy Tokens—with acceptance checks and a failure table. Not out-of-the-box SaaS multi-tenancy.