Tenant groups: content types, workflows and roles defined once for a group of tenants

A hotel chain runs every branch as its own tenant: the same room types, booking lifecycle, workflows and roles, with each branch's data visible only to that branch. Today roles are global (`Extensions/ServiceCollectionExtensions.cs:629`), but `ContentTypeDefinition` and workflow definitions are tenant scoped (`docs/multi-tenancy.md`), so each branch holds its own copy. Adding a field or fixing a workflow means repeating it per branch, and the copies drift.

### Why it matters

Similar processes across tenants is the normal case for a chain, a franchise, a school district or an agency's standard client setup. Blueprints apply once and then each tenant's copy is on its own.

### The general concept

Definitions owned by a group of tenants (the account in #898): content types, workflows, lifecycles, roles and site blueprints defined once at the group and used by every tenant in it. A tenant may add its own types beside them. Data stays tenant scoped.

### Where it lives

Core: content types, workflows, tenants.

### Compatibility

Released. Today's tenant-owned definitions keep working as tenant-local definitions. A shared definition changes through the versioned schema change in #934, applied to each tenant's entries by a job.

### Done when

- A field added to a group-owned content type appears in every tenant of the group, and entries in each tenant are validated against it.
- A tenant cannot edit a group-owned definition; a group admin can.
- A test with two tenants in a group and one outside shows the outside tenant unaffected.

Part of the decision on what a tenant is (#935).

Start by reading Extensions/ServiceCollectionExtensions.cs around line 629 and docs/multi-tenancy.md, then review the related decisions in #898, #934, and #935. Trace how content types, workflows, tenants, and roles are currently scoped. Done means group-owned definitions propagate to every group tenant, remain editable only by group admins, and leave an outside tenant unaffected in a two-tenant test.

Written by the indexing model from the issue text.