feat(capabilities/access): add access/grant binding

Mirrors the go-libstoracha access.Grant shape with UCAN 1.0 framing:

- Arguments carry an Attenuations list (capabilities the agent wishes
  to be granted) and an optional Cause CID. cid.Undef on Cause means
  no cause.
- OK aliases ClaimOK — a successful grant resolves into a bundle of
  delegation CIDs. Delegation envelopes themselves ride in the receipt
  response container as metadata, following the libforge pattern used
  by /access/claim and /access/confirm.
- Stable receipt failure names match the go-libstoracha originals so
  existing callers can keep their error matching.

This unblocks piri-signing-service's UCAN 1.0 migration: that service
gates all /pdp/sign/* abilities behind an /access/grant delegation and
needs a libforge binding to switch off go-libstoracha.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: frrist

capabilities/access/cbor_gen.go

@@ -30,6 +30,7 @@ func main() {
 		access.ClaimOK{},
 		access.ConfirmArguments{},
 		access.DelegateArguments{},
+		access.GrantArguments{},
 	}
 	const (
 		cborFile = "../cbor_gen.go"

capabilities/access/gen/main.go

@@ -0,0 +1,35 @@
+//go:build !codegen
+
+package access
+
+import (
+	"github.com/fil-forge/libforge/capabilities"
+	"github.com/fil-forge/ucantone/errors"
+)
+
+const GrantCommand = "/access/grant"
+
+// GrantOK mirrors ClaimOK / ConfirmOK: a successful grant resolves into a
+// bundle of delegation CIDs. The actual delegation envelopes ride in the
+// receipt response container as metadata.
+type GrantOK = ClaimOK
+
+// Grant can be invoked by an agent to request that a set of capabilities be
+// granted directly. Unlike Request -> Confirm, Grant is one-shot: the
+// executor decides immediately whether to issue the delegation.
+var Grant = capabilities.MustNew[*GrantArguments](GrantCommand)
+
+const (
+	UnknownAbilityErrorName    = "UnknownAbility"
+	MissingCapabilityErrorName = "MissingCapability"
+	UnknownCauseErrorName      = "UnknownCause"
+	MissingCauseErrorName      = "MissingCause"
+	InvalidCauseErrorName      = "InvalidCause"
+	UnauthorizedCauseErrorName = "UnauthorizedCause"
+)
+
+var (
+	ErrMissingCapability = errors.New(MissingCapabilityErrorName, "grant requires one or more capabilities")
+	ErrMissingCause      = errors.New(MissingCauseErrorName, "grant requires a supporting contextual invocation")
+	ErrUnknownCause      = errors.New(UnknownCauseErrorName, "unknown cause invocation")
+)