[ian-pascoe]

Summary

• Make Trust revocation independent of executable resolution while preserving durable record removal, lock ordering, and Owner signalling.
• Authorize named grants against only the selected project-controlled declaration; omit optional aggregate metadata when full resolution fails.
• Return the existing structured error for incomplete executable declarations instead of panicking.
• Add five isolated CLI regressions and mark Plan 009 complete.

Fixes #45

Scope and residual limitation

• This implements the bounded, schema-compatible scope chosen by Plan 009.
• Named status still requires the full all-declarations aggregate and fails when a sibling cannot resolve. Independent named-status success remains deferred; audit finding 9 is not completely resolved.
• No changes to schemas, persisted Trust format, digest algorithms, or Owner runtime.

Verification

• Reproduced named-grant/revocation failures and incomplete-declaration panic before the fix.
• Five integration regressions and both Trust unit tests pass.
• Full locked all-target fake-server suite: 129 passed, including 26 lifecycle tests.
• Clippy (-D warnings), formatting, schema registry, stored-state, and diff checks passed.
• Independent review cleanup finding addressed using the existing bounded panic cleanup guard.
• Verified on Linux; native macOS/Windows verification remains for CI.