Replace the broad channel-runtime principal check with owner-scoped rules so API callers can still read their own api_tenant_key and api_external_user sessions without opening IM sessions matched via legacy empty user_id scope.