PM-4988: Restrict project edit permissions for copilots

[jmgasper]

What was broken
Copilot project members were treated as eligible for project detail edits, so users with copilot project access could update project details through the Projects API.

Root cause
The named EDIT_PROJECT permission explicitly allowed copilot project membership, and the legacy UPDATE_PROJECT policy metadata still listed copilot and customer project roles.

What was changed
Removed copilot membership from the EDIT_PROJECT permission check. Updated the legacy UPDATE_PROJECT policy and generated permission documentation summary so project detail edits are limited to management-level project roles, manager-tier platform roles, admins, and machine project-write tokens.

Any added/updated tests
Added PermissionService coverage that verifies a project copilot cannot edit project details through either the named permission path or the legacy UPDATE_PROJECT policy.

Validation run:

• PASS: pnpm test -- src/shared/services/permission.service.spec.ts
• PASS: pnpm lint
• PASS: pnpm build
• FAIL: pnpm test currently fails in existing metadata event-publish specs where publishMetadataEvent is a no-op but tests still expect eventBusService.publishProjectEvent to be called.