feat(permissions): opt-in partial grant ownership — one module-scoped grant currently blocks 403 of 590 grants #102

Problem

ct.groupRole owns a whole role instance: every live grant absent from the declaration lands in
toDelete. So one unmanageable grant makes the entire role undeclarable — the repo's own doctrine
is that "a partial declaration is strictly worse than none: it turns a clean no-op into a
destructive plan".

On eqrm.church.tools that costs most of the estate. Of 590 authored per-group grants across 59
role instances, only 187 (44 instances) are declarable. The other 403 grants (15 instances)
are blocked — and often by a tiny minority of the grants in the role:

Every blocking dimension is module data — calendars, wiki, services, songs, resources, finance
queries, flow categories, OAuth clients — i.e. things the tool deliberately does not manage and
never will. The structural grants sitting next to them are perfectly expressible.

What is missing

An explicit, opt-in way to say: own these rights on this role; leave anything you do not recognise
alone. Sketch:

ct.groupRole({
  key: "team_office_leiter",
  group: "team_office",
  role: "Leiter",
  // Do not revoke live grants that are absent from `grants` — this role also carries
  // cc_html_template grants that this scaffold has no business owning.
  preserveUnknown: true,
  grants: [ /* the 40 structural ones */ ],
});

Requirements for it to be safe:

• Opt-in per declaration, never a global default — the current strict behaviour is the right
  default and must stay.
• Loud in the plan: render the preserved grants explicitly (~ N grant(s) preserved, not managed), so "I forgot one" and "I deliberately left module grants alone" never look alike.
• Ideally scoped, e.g. preserveUnknown: ["cc_html_template", "ccm_data_category"], so a
  genuinely unexpected new grant on a managed dimension still shows up as drift rather than being
  swallowed.

That last variant is the one I would build: it keeps the blast radius of the escape hatch to
dimensions the author has consciously excluded.

Acceptance

• A role can be declared with unknown grants preserved rather than revoked, opt-in only.
• The plan renders preserved grants explicitly; they are never invisible.
• Restricting preservation to named scope dimensions is supported.
• Default behaviour is unchanged: undeclared grant → revoke.

Context: full scope composition in eqrm/ct-structure docs/coverage-gaps.md.