feat: grant core + grants schema + validation (#117)

[pedromvgomes]

Part of #117. Foundational slice of ADR-0025 (the Grant capability), landing in dependency order ahead of the two provider slices.

What this slice ships (slice A — grant core + schema + validation)

No provider behavior yet — this is the abstraction, the manifest schema, and the credential-free inforge validate pass.

• internal/grant — the Grantable interface (Grant(...) stub + credential-free FieldNames(perm) (values, files)), Permission (ro|rw), Fields/FileMaterial, the grant.For(type) lookup, and the {FIELD} template machinery (ParseTemplate / Template.{Fields,HasLiteral,Interpolate}). Database publishes value fields {USER,PASSWORD,HOST,PORT,DBNAME}; PKIResource publishes file fields {CERT} (verify/ro) and {CERT,KEY} (issue/rw). FieldNames is credential- and instance-independent, so validation is real and testable without pulling in pgx or the PKI generate command — the Grant(...) bodies are clearly-marked stubs for slices B/C.
• Schema — grants: added to the service manifest (ServiceSpec + schemas/service.json): a list of {resource: <type>/<name>, permission: ro|rw, outputs: map[ENV]=template}, sitting with pki:/ingress:.
• PKI resource type (declarative only) — types.PKIResourceSpec + schemas/pkiresource.json + loader/validate enumeration for regional|global/pki/<name>/manifest.yaml (root-only, scope from folder). This is the one refinement to the proposed A/B/C split (confirmed before coding): slice A's pki/* grant-validation bullets (target-exists, root-only, cross-region) require the validator to resolve PKI-resource folders, so the declarative type lands here. The pki.enc.yaml sidecar, inforge pki generate, and the Grant/projection behavior stay in slice C.
• inforge validate — checkGrants implements every ADR "Validation" bullet credential-free: target resolves to a supported Grantable of the right shape; permission ∈ {ro,rw}; every {FIELD} is published for that permission; a file field must stand alone; output env names avoid reserved INFORGE_*/MTLS_* (reusing meshcert.DescriptorFiles()) and don't collide with environment.yaml keys or each other across grants. Cross-region boundary falls out of target resolution (shared regional set + global/ prefix), mirroring ref:. Plus checkPKIResource rejects a non-root-only PKI resource.

The bootstrapper is untouched (the point of the value/file field-kind split). Grants are not wired into deploy in this slice.

Follow-on slices

• B — Database Grantable: per-service NeonRole + ro/rw Postgres GRANTs over a CGO-free pgx owner connection; removes DatabaseOutputs.ConnectionURL (breaking — migrates ref:database/*.connectionUrl consumers).
• C — PKI resource Grantable: age-encrypted pki.enc.yaml sidecar, inforge pki generate, the verify/issue file-field Grant + file-output projection.

Tests / gates

• Table-driven unit tests for internal/grant (template parse/interpolate, field names, For, permission) and validate.checkGrants / checkPKIResource (all error paths + valid cases incl. global targets); the ok validate fixture gains a regional PKI resource and grants on the api service to exercise the end-to-end path.
• go build ./..., go test -race ./..., golangci-lint run ./... all clean.

Docs: internal/CONTEXT.md glossary (Grant/Grantable/PKI resource/Field/Output) already merged with ADR-0025; AGENTS.md gains a Grants section.