feat(epitrope): implement grant narrowing, validity, budgets and lifecycle

[forkwright]

What changed

crates/epitrope is the pure authorization core. It does no I/O, uses no tokio, and reads the clock only through an injected Clock.

• Grant narrowing. check_issue validates a proposed child against the designated grant on every axis, in contract order: capabilities, audit scope, session scope, target scope, each ceiling against the parent's remaining budget, validity window, depth, and issuer/parent link. A violation reports the failing axis back to the issuer as Denied{NarrowingViolation, axis}.
• Chain validity. check_chain walks leaf to root at clock.now().
  • A revocation on any ancestor invalidates every descendant without writing to each one.
  • now == expires_at counts as expired.
  • Depth must strictly decrease, so the walk always ends. A malformed link fails closed.
  • A view that answers with a record for a different id fails closed too.
• authorize. It authorizes against the designated grant's chain only.
  • A missing or foreign designated grant returns the same NotFoundOrDenied.
  • Target scope and session scope are checked on every link of the chain.
  • Each capability's session requirement is enforced here, not left to the daemon.
• check_revoke. A request may revoke only the designated grant or a grant descending from it, and the designated grant's chain must confer GrantRevoke. Any target outside that subtree, including another tenant's grant, gets the same NotFoundOrDenied as a missing one. Revoking an already-revoked grant is idempotent.
• Budgets. Each dimension has its own ceiling. plan_reservation checks every ledger along the chain, plus the session and tenant ledgers.
  • When the caller's own ledger is exhausted, the reply is BudgetExceeded{dimension}.
  • When an upstream ledger is exhausted, the reply is Denied{BudgetUnavailable} and names no dimension.
  • settle charges the actual use, never more than was reserved, and releases the rest. All arithmetic is checked.
• Lifecycle. The transition table matches the contract's B1–B5 states, and recovery_action gives the restart rule for each state.
• Dry-run planner. It runs over read-only view traits, which have no write methods. A refused plan's grant chain is empty.
• Audit (D17.7). Operator default scope is All; agents default to OwnAndOwnedSessions. RuleView has no audit accessor, and a compile-fail doctest proves it.

Contract amendments (the contract stays at v1; nothing has shipped): new syntheke codes DenyCode::BudgetUnavailable and DenyCode::SessionRequired, Denied{code, axis}, and NarrowingAxis::AuditScope. capability-contract.md adds:

• the authorization and attenuation check order;
• the session-requirement table and the revocation-authority rule;
• Own session scope, which covers descendant tenants;
• the validity-window and revocation-time rules;
• a Query request must name a session scope.

A new fixture, neg_session_required, is included.

Why

Phase 01 S2 requires every invocation to be authorized before any effect. This crate holds that logic with no I/O, so it can be tested exhaustively and cannot write.

Dependencies

Runtime: syntheke and snafu only. Dev: proptest 1.11 (alloc/no_std, a fixed ChaCha seed, no filesystem or OS entropy).

Stage and acceptance

Phase 01 S2. This PR proves the acceptance clauses for grant attenuation, expiry and revocation, and for cross-tenant read and metadata denial, at the authorization boundary. Dry-run can't write because the view traits have no write methods.

Proof (toolchain 1.97.1)

• epitrope: 85 tests plus doctests. They cover:
  • Every narrowing axis, and expiry and not-before at the exact boundary.
  • A revoked grandparent, a cyclic lineage, and a designated grant held by another tenant.
  • Every budget dimension, settlement overrun and overflow.
  • The full transition matrix and recovery actions.
  • Revoke checked against self, child, grandchild, sibling, ancestor, foreign and missing targets.
  • The session requirement for all 9 capabilities.
  • Identical dry-run plans for a foreign grant and a missing one.
• Property test (4096 cases, both directions): a child that passes narrowing is never broader than its parent, and a refused child is broader on at least one axis. Deliberately breaking the check makes the test fail.
• Workspace: 202 tests pass. clippy -D warnings, cargo deny check, cargo tree -d (only the documented syn skip) and the doc checks are clean.
• Two independent adversarial reviews: the second added view-id checks, depth re-validation in the chain walk, and closed the revoke and session gaps.