feat(adopt): bulk ct adopt grants, emitting the portable group+role form #104

Problem

ct adopt grants <domainType> <domainId> handles exactly one role instance and only prints a
block to paste. Adopting the declarable estate of eqrm.church.tools means 44 invocations and 44
manual pastes, each needing its key renamed by hand and its emitted numeric id: swapped for
the portable group + role form.

The printed block also defaults to the non-portable shape:

ct.groupRole({
  key: "group_role_44675",   // a logical key, unique across the config — rename to taste
  id: 44675,                 // ← host-specific; the portable form is group + role
  grants: [ … ],
});

Both of those are exactly the edits a human will forget on the 30th paste.

What would help

• Bulk selection, mirroring ct adopt group's existing --type / --children-of forms:
  ct adopt grants --group <key> (all roles of one group), --all-declarable, or a list of ids.
• Emit the portable form by default — group: "<logical key>" + role: "<name>" whenever the
  group is managed, falling back to id: only when it is not. The resolver already does
  (group, role) → domainId, so the reverse is available.
• Derive the key from the group key + role name (skidscheckinopskoblenz_mitglied) instead of
  group_role_44675. That is the convention every consumer will adopt anyway.
• Optionally --write to append into the config file rather than printing.

Nice-to-have: skip what cannot be adopted

With #102 unresolved, a bulk run should quietly skip role instances whose grants include a scope
dimension with no ref kind, and summarise them at the end — otherwise a bulk adopt emits blocks
that would revoke live grants if pasted, which is the one outcome the WARNING footer exists to
prevent.

Acceptance

• One invocation can emit blocks for every declarable role instance of a group, or of the host.
• Emitted blocks use group + role and a derived key when the group is managed.
• Blocks that would revoke live grants are not emitted silently in bulk mode.