feat: administer explicit experience sharing grants

[fabbrik]

Summary

Story 3.1, first of Epic 3. Scope stops being all-or-nothing, without weakening it.

• Administrator authority is explicit. A GrantAdministration the host constructs — never derived from an AuthorizationContext, a role string, or the requesting scope. Missing it is a typed Denied before any connection opens.
• A grant names one record and one recipient scope, keeps the same tenant, application and project, carries a reason and an expiry, and is rejected if it is a no-op or crosses a boundary. The owner scope is copied from the record by INSERT ... SELECT, so a caller cannot assert who owns what.
• Grant and audit event commit together, and the event insert's rowcount is asserted, so a grant can never commit unaudited. GetHistoryAsync exposes the trail through the port.
• At most one active grant per recipient (unique partial index), so revoking the grant you know about genuinely ends that recipient's access.
• Reads widen in SQL only. Get, text search and vector search match exact scope or an active grant — correlated on both halves, expiry evaluated with clock_timestamp() so a caller-held transaction cannot keep an expired grant alive. Writes, lifecycle commits, history and enumeration stay owner-only.
• Borrowed experience is visible. The read that applied the predicate marks the record shared; Core and the injection provider keep strict scope equality for anything unmarked, the host's risk policy can deny on that flag alone, and the Historical Reference block tells the model the lesson came from another scope.
• Degrades instead of breaking. A database without 0005, or a role with SELECT only on the records table, falls back to exact-scope reads and notifies the host — degrading only ever narrows a read.

Review

Three reviewers raised 31 findings; 28 fixed, 3 deferred with named owners. Blind Hunter could not construct a case where the predicate admits a record the grant does not name. The serious ones: grants initially broke un-migrated and least-privilege deployments; relaxing the Core and MAF scope guards had weakened defence in depth (fixed by the marker above); an audit event could silently not be written; and revoking one of several overlapping grants did not end access.

Not in this PR

Tamper-evident grant state (a direct UPDATE can still clear a revocation) is assigned to 3.2, which owns the same question for lifecycle events. Grant purge, a lifetime ceiling and read auditing are assigned to 4.5 and to a new story 3.5.

Test plan

• dotnet build --configuration Release: 0 warnings, 0 errors
• dotnet test --configuration Release: 746 of 746 pass (Postgres 165, Core 394, MAF 90, Vectors 45)
• Container tests per edge-case row, including create and revoke atomicity, expiry at the database clock, a tampered grant's owner scope still denied, the degraded-deployment path, and that a grant confers no write, no history and no enumeration
• CI green

🤖 Generated with Claude Code