feat(cubesys): Task 6b — permission grants (PDF flags 5-19)

Add a delegated-grant auth layer:
- cubesys/src/grants.rs: Grant/Owner/Perm model, GRANT_BUCKET at
  Czyx::new(0,1,0,1), grant/revoke/grant_allows, std-only JSON codec.
- Stored via put_record with a doc_type='grant-table' header so it
  survives checkpoint/restore (raw put_raw was dropped on dump_store).
- commands.rs: GRANT/REVOKE opcodes + admit_mutate() enforcement hook
  (owner -> grant -> deny). GRANT/REVOKE require HELLO identity under
  --require-identity.
- Enforce owner-match contract preserved (legacy/tests stay green).
- 11 new grant tests; full ./check quick = 115 pass, clippy -D clean.

cubesys/src/store.rs

@@ -602,7 +602,9 @@ impl ConcurrentStore {
         code: &[Op],
         owner: Option<&str>,
     ) -> Result<Czyx, crate::SysError> {
-        let coord = self.with_mut(|store| crate::store_code_cell(store, path, kind, name, links, code, owner))?;
+        let coord = self.with_mut(|store| {
+            crate::store_code_cell(store, path, kind, name, links, code, owner)
+        })?;
         if let Some(v) = self.get_raw(&coord) {
             self.log_put(coord, v);
         }