#2754 serve: define and supply the collective and owner grant condition variables

Found in swamp-club#2675. The grant condition environment declares collective (workflow, model) and owner (data), and they are documented in design/enablers/access-control.md, but no serve handler supplies them. Since swamp-club#2675 a condition that needs a resource field the resource does not carry fails closed, so a deny on collective or owner refuses every request of its kind and an allow never matches; the policy loader logs a warning naming such grants. Needed: define their sources (for example the collective of a model type's namespace, and the creator of a data item recorded in its provenance), supply them in the canonical resource builders in src/serve/handlers/resource_resolution.ts, and update the design doc.