My wild ass guess is that Contact has a required standard field that's can't be written to.
And to find the exact field - put the logic into a unit test.
Start with a method that has one runas user - the customer community user.
Duplicate the problem.
Then fix that with a method that has two runas users - one with a customer community profile - and another ...
Has per @KrisGoncalves's comment, I updated the Sharing Set to allow Read/Write for the selected Account and it started to work.
I realized why read/write sharing is required for Account. Since Account is the parent (in sharing terms) for Contact and Contact is the master details parent for Ticket__c, I actually have to have write sharing on Account ...
Couple of things here.
First of all:
Class connected to manual sharing and trigger for apex managed sharing are connected to two different things.
Manual sharing is not persisting. That means it would be removed (manual sharing added to the user) on owner change for example. Sharing recalculations would be triggered and all of the manual sharing are removed ...
Your community user have access to the Contract record because that user is created based on the Account/Contact which shares access to it.
Indirect relationship does not give that access without any additional configuration (well it's called indirect relationship for a reason -> indirect relationship is a normal Detail side of the Account-Contact Master ...
In Salesforce Classic, users who don’t have Read access or the View All Lookup Record Names permission see an underscore in system user lookup fields. They also see the record ID in custom user lookup and non-user lookup fields.
After the Require permission to view record names in lookup fields setting is enabled, in Lightning Experience, users who don’t ...
You will need to remove Create access from the Profile, then generate one permission set:
that grants Create access on the object. Assign that Permission Set to the two (2) users.
Permission Sets are additive in permissions to the underlying profile so you'll want to start with a profile that grants no Create access, then add in permissions