#22284 Retire stale Cloud sockets after team role changes

Role changes closed team connections but left the member’s Cloud connections open. Cloud connections now retain their TeamDO authority version; durable notices retire stale connections and preserve newer admissions. If membership cannot be checked, affected connections close and delivery retries.

Builds on #22281. At 85176be929b2, all 975 API tests pass, including seven Cloud-wire cases and eight authority-race cases. Parent observation and receiving Native/service authorization remain follow-ups.

Changelog

Fixed: Cloud subscriptions reconnect with current permissions after team role changes.