Add colleagues to a group you are in.

PARTICIPANTS ONLY, and deliberately not _dm_or_404: that helper grants an admin access to a case room, and "can read this conversation" is not the same permission as "can decide who else reads it". Membership is checked directly.

Scoped to kind='group'. A case room's roster is owned by routing -- it is the team on a case, and it changes when an assignment does, not when somebody in the room decides -- and a two-party DM's privacy is the entire thing it is: silently turning one into a three-way conversation would break a promise both participants are relying on.