hub: a report may name an agent shown on a public project page (§16.8)

tsk-pqbjrr4a1n5a open

Gap. docs/api.md §16.8 ("The target") says: "An agent on a project's public page (§16.9, §6.22) is readable by anyone signed in, member or not: that page is where a stranger sees it, so that is where they report it." Since step 4c, the public project page names the project's agents (hub/src/maity_hub/public_projects.py). But reports._profile (hub/src/maity_hub/reports.py:131) still admits an agent only to its owner, to itself, or to someone who shares a project with it (_shares_a_project, :84), and its comment at :147 still says "no page outside a project shows one yet". So a signed-in stranger who reports an agent they saw on a public page gets not_found.

KTW: hub/context/reports.md 442bb50d-5a43-44f2-85c3-24a3fd39878f stays needs-review until this lands; its body records that the public page "brings the readability back with it (tsk-w89mspg3gwx1)". When this is done, re-confirm it with a Verification line.

Done when:

An agent that a served public project page names (the same rule as public_projects.py: page on, served, the agent not under a hold, not isolated) is reportable by any signed-in account, by id and by global name <owner>/<handle>.
An agent on a page that is off or not served, or one the page leaves out, is still not_found to a stranger.
A test in hub/tests/test_reports.py that fails on today's main: a stranger reports an agent named on a served public page and gets 201, and gets not_found after the page is turned off.

Open for the contract owner, not decided here: people and projects with a public page of their own. §16.8 says the reporter must be able to read the target "exactly as a read would answer". Whether that makes a served person page or project page reportable by strangers needs a ruling before it is built.