Persist opaque file handles through IndexedDB durable grants

[wieslawsoltes]

Problem

WebScene supports same-origin transient structured clones of FileSystemHandle, but its IndexedDB serializer deliberately rejects handles because a process-local live grant cannot survive authority/runtime restart. AppScene #159 now provides the missing authority: exact profile + storage-partition + serialized-origin bound 32-byte durable locators, plus fresh-grant restoration and revocation.

Focused scope

• Add a product-neutral v2 WebScene durable-grant request/completion ABI and bounded broker for export, restore, and revoke.
• Store FileSystemFileHandle and FileSystemDirectoryHandle in WebScene IndexedDB by asynchronously exporting their live opaque grants before the database commit.
• Persist only a versioned bounded envelope containing V8 structured data plus fixed opaque locators. Never persist a live token, raw path, bookmark, filesystem identity, descriptor, or native object.
• On load or engine restart, restore each locator through the native authority using the engine's exact storage partition and the document's serialized origin, then create ordinary fresh live-grant handle wrappers.
• Reject wrong origin/profile/partition, tamper, stale generation, cancellation, changed/missing entries, malformed envelopes, and authority failures without deserializing ambient authority.
• Revoke superseded or deleted locators after the durable database mutation succeeds, and retire pending export/restore/revoke work exactly once across navigation and engine teardown.

This child does not add file/directory create/delete operations, raw-path persistence, new permission authority, or product-specific behavior. It does not touch #379, #239, or consolidation #76.

Direct gates

• WPT fs/script-tests/FileSystemBaseHandle-IndexedDB.js pinned at 76fdb39425f8319118cba6c0c961e1d835c2879f plus Chrome oracle.
• File and directory handles in a pending transaction, a new transaction, mixed with Blob, cursor retrieval, and same-entry identity.
• Two-engine restart, exact and wrong origin/partition bindings, malformed/tampered/stale native results, cancellation and stale completion, navigation/retirement, replacement/delete revocation.
• 100 lifecycle cycles, 10,000 broker operations, heap/RSS/FD/retained-byte bounds, ASan/UBSan, strict C11 layout, exports, portable ABI, and an exact AppScene aadf606d adapter compile.

Refs #248