feat(app): exclude org-wide admin groups from aggregated member lists

[quiiver]

What

sre-admins and cloud-engineering-admins are org-wide admin subgroups composed
into ~every workgroup (they're childOf ~100 groups), so their users flood every
workgroup's aggregated Members card. This excludes those two groups' users from
a group's aggregated member list — except when viewing those groups, or their
parent workgroups (cloud-engineering / sre), directly.

Frontend display only — no catalog, relation, ownership, or permission changes.

How

• packages/app/src/components/catalog/workgroupMembers.ts — a pure helper
  (aggregateMembers) mirroring the org plugin's direct + descendant aggregation
  (BFS over RELATION_PARENT_OF, members via relations.memberof), but pruning
  the excluded admin-group branches during the descent when shouldPrune(root).
  Prune-descent semantics: a person reachable only via an excluded admin group is
  dropped; a person who is also a genuine direct/other-subgroup member still shows.
• packages/app/src/components/catalog/WorkgroupMembersListCard.tsx — renders the
  result; replaces the stock MembersListCard inside the existing
  TypeAwareMembersListCard in overrides/org.tsx (aggregated = spec.type === 'workgroup').
• Excluded set is a hardcoded constant (can move to app-config later).

Verification

Unit tests cover the pruning (incl. the "also a direct member still shows" case) and
the component asserts a pruned-branch user is not rendered. Non-excluded groups'
aggregated counts stay algorithmically identical to the stock card. tsc, lint,
prettier clean; app builds.

Notes (optional follow-ups, from review)

• shouldPrune's parent-workgroup exemption is whole-tree, not per-branch (fine for
  these admin-org pages).
• Focused Table render intentionally drops the stock avatar-grid + aggregate/direct
  toggle; search + pagination preserved. Parity is a follow-up if wanted.