Agent tabs follow your permissions, and a clearer delete for a site's only agent

An agent shows each member the tabs they can open. Without the Agents: Edit permission, an agent's tab row now holds only Evaluations, opening the agent lands on its versions page, and each version in the name menu opens its read-only page. An old link to Identity, Capabilities or Instructions keeps the agent's header and says you don't have access to that section, instead of sending you elsewhere without a word.

One Open item in the agents list menu. View and Edit went to the same place, so the ⋯ menu now has a single Open (plus Delete for members who can edit agents).

Deleting a site's only agent says what to do. The agent that answers on your site still needs another agent to take over before it can go. When it's the site's only agent, its delete dialog now says so: take it offline first, or use Create an agent. Over the API, the 409 agent_answers_on_site response's detail names that case too.

Smaller fixes:

• An agent avatar upload that fails now says why: wrong file type, over 2 MB, no permission, or an upload to retry. Before, most failures read as "too large".
• In the engagement widget editor, a save with an invalid field opens the tab that holds it, and a refused save says why. Holding Ctrl+S (or Cmd+S) saves once, and the shortcut does nothing while a dialog is open.
• On the widgets list, the List/Gallery switch no longer shows between 768px and 860px wide, where it was visible but did nothing.