feat(storage): scoped grants (subtree, ro/rw), narrow-only, release revokes all holders; IPC KEEP_DELEGATE opt-in; shell cd/pwd, programs get ro cwd

crates/apps/cat/src/main.rs

@@ -36,6 +36,7 @@ extern "C" fn main() {
         match cat(&mut fs, path) {
             Ok(()) => {}
             Err(FsError::NotFound) => println!("cat: {}: no such file", path),
+            Err(FsError::Denied) => println!("cat: {}: outside what it was given", path),
             Err(_) => println!("cat: {}: cannot read", path),
         }
     }