feat(storage): scoped grants (subtree, ro/rw), narrow-only, release revokes all holders; IPC KEEP_DELEGATE opt-in; shell cd/pwd, programs get ro cwd

crates/domain/src/message/mod.rs

@@ -11,6 +11,8 @@ pub const MAX_MESSAGE_WORDS: usize = 4;
 pub struct Message {
     words: [usize; MAX_MESSAGE_WORDS],
     cap: Option<CapSlot>,
+    /// The receiver may pass `cap` on (see `syscall_abi::KEEP_DELEGATE`).
+    keep_delegate: bool,
 }
 
 impl Message {
@@ -19,7 +21,11 @@ impl Message {
     }
 
     pub fn from_words(words: [usize; MAX_MESSAGE_WORDS]) -> Self {
-        Self { words, cap: None }
+        Self {
+            words,
+            cap: None,
+            keep_delegate: false,
+        }
     }
 
     pub fn with_cap(mut self, slot: CapSlot) -> Self {
@@ -39,4 +45,13 @@ impl Message {
     pub fn cap(&self) -> Option<CapSlot> {
         self.cap
     }
+
+    pub fn keeping_delegate(mut self) -> Self {
+        self.keep_delegate = true;
+        self
+    }
+
+    pub fn keeps_delegate(&self) -> bool {
+        self.keep_delegate
+    }
 }