Artifacts support a public read path for readers outside the owner's org

What

• Reading an asset from an artifact (read_asset) now supports a distinct "public read" path used when the requester is outside the artifact owner's organization. The read result gains a public_read/public marker, the underlying fetch function takes a new admitPublicRead callback and returns publicRead in its result, and a dedicated public_refused error reason covers the case where a public artifact doesn't serve that asset to outside readers.
• A companion refusal path gains a public_outside_org case, returning the same message text used in the resume_replies flow. Share-status records now also track an outsideOrgReader flag, cleared whenever the account boundary changes, alongside the existing probeErrorCode and role fields.

Why This gives artifacts a defined public-read path for people outside the owner's organization, with clear refusal messages when that access isn't available, instead of treating all outside-org reads the same way.