obsidian_headless: grant the service user on shared folders too (WDWL-22)

Content multica creates in inbox/ is owned multica:multica, so obsync fell
into "other" (---) and Sync could neither read nor upload Wong's
submissions. Found after the real Sync sign-in on spaceship-earth; the
earlier verify only tested the obsync -> multica direction.

Shared folders now carry user:obsync:rwx as an access and a default entry
alongside the shared user's, and verify tests the multica -> obsync
direction (read + rewrite, as merge needs). Second run changed=0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/obsidian_headless/README.md

@@ -25,7 +25,7 @@ only. Entry point: `playbooks/provision-wong-host.yml`.
    | `/srv/obsidian/` | `0710 obsync` | `user:multica:--x` |
    | `/srv/obsidian/vault/` | `0710 obsync` | `user:multica:--x`, so `multica` can traverse but not list |
    | `vault/everpure/`, `vault/wip/` | `0700 obsync` | none |
-   | `vault/inbox/` | `0770 obsync` | `user:multica:rwx`, plus the same as a **default** entry |
+   | `vault/inbox/` | `0770 obsync` | `user:multica:rwx` and `user:obsync:rwx`, each also as a **default** entry |
 
    On a directory with an ACL, the mode's group bits are the ACL mask. A
    `chmod 0700` would therefore void every named entry, which is why the
@@ -38,6 +38,9 @@ only. Entry point: `playbooks/provision-wong-host.yml`.
    - `multica` writes, reads and deletes in `inbox/`.
    - A folder and file created by `obsync` under umask `0077` (the way Sync
      creates them) stay readable and writable by `multica`.
+   - What `multica` creates stays readable and writable by `obsync`. Those
+     files are owned `multica:multica`, so without the named `user:obsync`
+     default entry Sync could not read them and would never upload them.
    - `multica` is refused both listing the vault root and listing or writing
      `everpure/` and `wip/`.