obsidian_headless: grant the service user on shared folders too (WDWL-22)

Content multica creates in inbox/ is owned multica:multica, so obsync fell
into "other" (---) and Sync could neither read nor upload Wong's
submissions. Found after the real Sync sign-in on spaceship-earth; the
earlier verify only tested the obsync -> multica direction.

Shared folders now carry user:obsync:rwx as an access and a default entry
alongside the shared user's, and verify tests the multica -> obsync
direction (read + rewrite, as merge needs). Second run changed=0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/obsidian_headless/tasks/layout.yml

@@ -4,8 +4,13 @@
 #   <parent>/            obsync 0710  + user:<shared>:--x   traverse, no listing
 #   <vault>/             obsync 0710  + user:<shared>:--x   traverse, no listing
 #   <vault>/<private>/   obsync 0700                         nobody else
-#   <vault>/<shared>/    obsync 0770  + user:<u>:rwx, and the same as a
-#                                       DEFAULT entry, so new children inherit
+#   <vault>/<shared>/    obsync 0770  + user:<u>:rwx and user:obsync:rwx,
+#                                       each also as a DEFAULT entry, so new
+#                                       children inherit both
+#
+# The user:obsync entry matters for content the SHARED user creates: that is
+# owned <u>:<u>, so without a named entry obsync falls into "other" (---)
+# and Sync can neither read nor upload it.
 #
 # The owning group is obsync's private group, so its bits grant nobody. On a
 # directory that carries an ACL, the group bits of the mode ARE the ACL mask,
@@ -62,6 +67,18 @@
   loop_control:
     label: "{{ item.path }}"
 
+# Each shared folder gets its user AND the service user, both as access and
+# default entries.
+- name: Layout | Build the shared-folder grants
+  ansible.builtin.set_fact:
+    _obh_grants: >-
+      {{ (obsidian_headless_shared_folders
+          + (obsidian_headless_shared_folders
+             | map(attribute='path')
+             | map('community.general.dict_kv', 'path') | list
+             | map('combine', {'user': obsidian_headless_user}) | list))
+         | unique | list }}
+
 - name: Layout | Grant shared folders (access and default entries)
   ansible.posix.acl:
     path: "{{ obsidian_headless_vault_path }}/{{ item.0.path }}"
@@ -70,6 +87,6 @@
     permissions: rwx
     default: "{{ item.1 }}"
     state: present
-  loop: "{{ obsidian_headless_shared_folders | product([false, true]) | list }}"
+  loop: "{{ _obh_grants | product([false, true]) | list }}"
   loop_control:
     label: "{{ item.0.path }} -> {{ item.0.user }}{{ ' (default)' if item.1 else '' }}"