Safer guest role permissions

Guest role boundaries now remain enforced for custom and inherited roles.

Guest access now stays within the customer collaboration permissions designed for guests, including when you use custom roles or role inheritance. New workspace permissions also remain unavailable to guest roles until they have been reviewed for guest-safe data access.

When a custom guest role is deleted, organization members now return to the standard Guest role instead of receiving a staff role.