feat: auto-select the gating group; 'party' becomes the fallback

Bare 'party host' now walks staff, users, wheel, party and gates on
the first group the caller belongs to, announcing the pick. Boxes
where people already share a system group need no setup; the curated
'party' group remains the fallback and the explicit --group /
TMUX_PARTY_GROUP paths are unchanged. Caller membership is the only
probe (id -nG, portable everywhere); whether a guest is a member stays
an invite-time warning, where it can actually be answered.

party.1

@@ -1,5 +1,5 @@
 .\" party - share a tmux session with the people you already work with
-.Dd April 30, 2026
+.Dd July 11, 2026
 .Dt PARTY 1
 .Os
 .Sh NAME
@@ -121,8 +121,12 @@ Group precedence:
 .Fl -group
 flag >
 .Ev TMUX_PARTY_GROUP
-> the default
-.Ql party .
+> auto-selection, which walks
+.Ql staff ,
+.Ql users ,
+.Ql wheel ,
+.Ql party
+and gates on the first the host belongs to, announcing the pick.
 .It Cm close Op Ar name
 Tear down the party server and remove its per-party directory.
 With no
@@ -232,9 +236,9 @@ Show the caller's own state: hosting, attached, or idle.
 .Bl -tag -width "PARTY_SOCKET_DIR"
 .It Ev TMUX_PARTY_GROUP
 Shared system group used for socket access.
-Default
-.Ql party .
-Override to reuse an existing group like
+When unset, the group is auto-selected at host time; see
+.Cm host .
+Override to pin an existing group like
 .Ql wheel ,
 .Ql users ,
 or
@@ -243,6 +247,10 @@ or pass
 .Fl -group Ar name
 to
 .Cm host .
+.It Ev PARTY_GROUP_CANDIDATES
+Space-separated candidate list for host-time group auto-selection.
+Default:
+.Dq staff users wheel party .
 .It Ev PARTY_SOCKET_DIR
 Where each party's per-party private directory (and its socket and
 roster) is created.