feat: broker-scoped Grok inference grants for evaluators and fresh slot preflight receipts

[apresmoi]

Summary

• New control verbs request_inference_grant / release_inference_grant (uid 2000 only via the native relay's SO_PEERCRED): short-lived, model/effort-scoped proxy grants so Paideia judges and the optimizer share the broker's credential authority without holding the refresh token.
• Grants are a distinct kind in the proxy (inference_ bearers, own map and meter): exact model/effort, no tools/tool_choice, canonical forwarding, one request in flight, TTL ≤ 10 min with in-flight abort, 64 requests / 2M tokens per grant, at most 8 live grants.
• Inference usage goes only to inferenceLedgerPath (service.json v2), rows kind: "inference" deduped by grant+request; the wake fuse ignores them. Stale realm surfaces as auth_stale for grants.
• renderGrokInferenceClientConfig (sha-pinned per model×effort): lean judge client config with max_retries = 0 (default retries hung refused judges >45 s).
• Slot preflight receipt v2 adds supervisor generation and caller nonce; the verifier requires {expectedNonce, minGeneration} and refuses v1.

Stacked on #26.

Verification

• Full npm test: 778 pass / 0 fail (one unrelated load flake on the first run). Typecheck, build, verify:contract-manifest, verify:production-closure pass.
• 14 mutation checks red → green.
• Live zero-cost check (real proxy, relay, launcher, Grok 1.0.34 judge CLI and subject worker against a stub upstream): only uid 2000 obtains grants; a judge call runs alongside a subject turn with separate ledgers; undeclared effort and tools refused before upstream.
• Cross-vendor (Grok) review: no P0–P2 findings.

🤖 Generated with Claude Code