fix: authorize allowlisted WhatsApp group chats

[mgonto]

Summary

• authorize WhatsApp group messages by chat-scoped group_policy: allowlist / group_allow_from
• keep DM allowlists scoped to DMs so WHATSAPP_ALLOWED_USERS no longer blocks members of an explicitly allowed group
• add regression coverage for group allowlists alongside DM allowlists

Tests

• scripts/run_tests.sh tests/gateway/test_config_driven_access_policy.py tests/gateway/test_relay_upstream_authz.py tests/gateway/test_whatsapp_group_gating.py -v --tb=short
• git diff --check HEAD~1..HEAD

[alt-glitch]

This was generated by AI during triage.

Related: #53623 (broader WhatsApp group-authz + owner-detection PR, same gateway/authz_mixin.py) and #43929 (group allowlist in the Node bridge). This PR is the narrow group-allowlist subset of #53623's scope — competing OPEN approaches, flagging for a maintainer to pick narrow-vs-broad.

[teknium1]

Thanks for isolating the WhatsApp group-vs-DM allowlist case; current gateway/authz_mixin.py:459-605 still denies that scenario, so the regression is valuable.

Problems

• gateway/authz_mixin.py:211 and :214 on this PR use the default self.adapters registry without source.profile. Current main deliberately resolves inbound authorization through _authorization_adapter(platform, source.profile) and fails closed for missing secondary-profile adapters (gateway/authz_mixin.py:34-59). The new early allow path must use that resolver or a secondary profile could inherit the default profile's allowed WhatsApp group.
• The added test (tests/gateway/test_config_driven_access_policy.py:292) covers only the default adapter. It does not exercise the profile-isolation path introduced on main by bb304b491.

Suggested changes

• Salvage the narrow early group-chat authorization check using _adapter_for_source(source) and profile-aware policy lookup, then add a secondary-profile regression with differing group allowlists.

Automated hermes-sweeper review.

[teknium1]

Current main resolves authorization through the source's profile-specific adapter and fails closed when that adapter is absent (_authorization_adapter). This direct default-registry lookup can authorize a secondary-profile WhatsApp event with the default profile's group allowlist; resolve from source.profile instead.