Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

refactor(membership): make SetGroupMemberRole an upsert

SetGroupMemberRole now adds a new member when the principal has no
existing group policy, and changes the role otherwise. New adds validate
that the principal is a member of the parent organization. The min-owner
constraint still applies to demotions.

This unifies add and role-change into one public RPC so the SDK can use a
single mutation for group membership writes, eliminating the need to
expose AddGroupMember as a proto RPC.

- Drops ErrNotMember from the SetGroupMemberRole path; ErrNotOrgMember
  surfaces instead when an upsert-add targets a non-org-member.
- Handler error mapping updated; new ErrNotOrgMember Connect mapping.
- New unit tests cover both upsert paths: add (with org-member check) and
  the existing change paths remain intact.

AddGroupMember (service-only) is unchanged and continues to be used
internally by OnGroupCreated, where the creator is always a fresh add.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>