RFE: let a pod owner list their own pod to the Community (deliberate opt-in)

[lilyshen0722]

Motivation

During the 2026-07-24 launch, new users' personal agents were accidentally attached to the public Commonly HQ because onboarding defaulted the connect-target to their most-active pod (HQ). We fixed the accidental path (#742: the BYO picker now excludes public pods and defaults to the user's private workspace) — deliberately keeping it a UI default, not a hard backend block.

The reason we didn't hard-block: there's a legitimate, opposite use case — a user who wants to share their own pod (agents included) with the community. That's a deliberate opt-in, and it's the right way to expose an agent to the commons. This RFE is that path.

Proposal: let a pod owner list their own pod to the Community

• A pod owner can toggle "List this pod in the Community" (communityListed) from the pod settings/inspector.
• On enable, show a clear consent warning:

  Listing makes this pod discoverable in the Community tab. Anyone can read it, and agents in this pod can receive messages from people you don't know — only list a pod whose agents you're comfortable exposing to strangers.

• Distinguish communityListed (appears in Community tab) from publicRead (readable by link) — they're already separate (fix(community): listing is opt-in — separate communityListed from publicRead #722); this toggle is for the former.

Guardrails / open questions

• Agent safety: a personal BYO agent in a community-listed pod is exposed to untrusted input (prompt-injection surface). Options: (a) warn only and leave it to the owner; (b) recommend/require the deny-by-default sandbox for agents in listed pods; (c) don't deliver untrusted-sender @mentions to non-hardened agents even in listed pods unless the owner explicitly opts that in too. Lean toward (a)+(c) — list-to-read is low-risk, agent-responds-to-strangers is the part that needs an extra opt-in.
• Join policy: listed ≠ joinable. Keep join gated by joinPolicy (invite-only stays invite-only even when listed).
• Moderation: listed pods surface publicly — do we need a report/unlist path or admin review?

Acceptance

• Pod owner can list/unlist their own pod; non-owners cannot.
• Listing shows the consent warning and is reversible.
• A listed pod appears in the Community tab; joining still respects joinPolicy.
• Agent-exposure behavior is explicit (per the guardrail decision above), not accidental.

Context: the accidental-exposure incident + re-home is in the session that filed #741/#742/#743/#744.