feat(rustd): the execution policy assembles, and a grant is a set the caller names

The lease's answer is one `ExecutionPolicy`, and this is the only place that
knows its whole shape — a second assembler would be a second opinion about what
a run is allowed to do.

The grant set is a type. A mintable credential whose integration has no
standing approval PARKS the lease rather than degrading to "not available",
because minting reaches a third party under the workspace's own authority and
that needs a human's standing answer. Fail-closed is only safe if a caller
cannot reach it by accident, and `&[Box<str>]` spelled "this workspace granted
nothing" and "nobody has read the grant rows yet" the same way — `&[]`. A
caller that forgot the read would inherit the safe behaviour and never learn it
forgot, surfacing later as leases parking on integrations an operator can see
are granted. `Grants` has no zero-argument constructor; the empty set is
`Grants::none()`, which someone wrote on purpose.

The grant set is also not an `Inputs` field. Everything in that bundle is
borrowed BY the assembled policy; the grant set decides whether there is a
policy at all and contributes no bytes to one. Sharing the lifetime made the
borrow checker demand a caller hold its grant rows for as long as the lease
answer they have nothing to do with — so `assemble` takes them as their own
argument, and `Assembled<'a>` borrows from the inputs alone.

`first_ungranted` answers with the credential it found, not with a pre-built
`Assembled`. A search says what it found; leaving the outcome to the one
function that owns it keeps a park from being constructible in two places.

Also: the crate's `Result` alias on both fallible signatures here (RULE ERR-RS
— a reader must not have to check WHICH error a signature returns), one
traversal of the secrets map instead of two, and the three test modules in this
directory share one document fixture instead of each rebuilding it.

afd_fleet 173 unit tests green, up from 167 — the park path had no coverage at
all before this, and now has three cases including a partial grant set.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>