feat(plugins): grant delegation and revocation

[MerhiOPS]

Summary

• Plugin-grant registry — delegate_grant, revoke_grant, revoke_all_grants, is_delegated, list_delegated_grants layered on top of grant_store
• Plugin API — context.grants.bindFsScope(), context.grants.list(), grant revocation events with handle invalidation
• App-facing API — delegateGrant, revokeGrant, prefetchFor exposed through volt:plugins runtime module
• Deactivation cleanup — auto-revokes all delegated grants via clear_plugin_registrations_locked

Test plan

• Plugin-grant registry: delegate, revoke, revoke-all, list, duplicate rejection, re-delegation after revoke
• Plugin-side: bindFsScope valid/invalid/revoked, list grants, revocation event received, inert handles
• Host-side: delegate → plugin can bind, revoke → plugin gets event, deactivation revokes all
• Runtime: delegateGrant/revokeGrant roundtrip through Boa, prefetchFor available
• All files under 300-line soft cap