feat(permissions): let group_type_role domains on same-run group types and roles go pending

[2000game]

Follow-up to #182 / #187. Found in review of #187 and confirmed with a throwaway plan test against the PR head.

Since #187, ct.groupTypeRole needs groupType + role, and the pair resolves against /group/roles at plan time. That resolution never goes pending, so two configs that should converge in one ct apply fail at plan time instead:

1. Same-run group type. ct.groupType({ key: "mt" }) plus ct.groupTypeRole({ groupType: "mt", role: "Leiter" }) on a fresh host: plan aborts with group type "mt" is declared in this config but not yet created. Before fix(permissions)!: address group_type_role by role, not by group type (#182) #187 this went pending (bug(permissions): domain-by-reference to a not-yet-created group type aborts the entire plan — fresh-instance rehearsal impossible #69), but that path wrote to the type id, so it was never correct. It only didn't error.
2. Same-run role definition. ct.roleDefinition({ name: "Coach", groupType: "mt" }) plus ct.groupTypeRole({ groupType: "mt", role: "Coach" }) on a host without Coach: plan aborts with group type feat: Phase 3 — Declarative engine (config format, diff/plan, dependency graph) #5 has no role named "Coach" … Fix the role name, or pass a numeric id. Both remedies in that message are wrong here. group_role already handles this case (A groupRole whose ROLE is created in the same run hard-errors — the #106 pending fix covers the group, not the role #120).

Fix shape: mirror #106/#120. Carry the ref as a pending domain and, after executePlan, finish it with a live /group/roles read in applyPermissionPlan. Keep the plan-time error when the config declares no matching role for that type.

Smaller items from the same review:

• The ambiguity error in resolveGroupTypeRole recommends { kind: "role-def", key }, but ct.groupTypeRole's role only takes a name. Either accept a role-def key there, or point the message at something the DSL can express.
• ct adopt grants group_type_role <id> prints a numeric role id with a placeholder comment. ReverseResolver.roleGroupTypeCatalog() plus idToKeyByKind("group-type") (already used in adopt-group.ts) could print the portable groupType + role form directly.