feat(storage): scoped grants (subtree, ro/rw), narrow-only, release revokes all holders; IPC KEEP_DELEGATE opt-in; shell cd/pwd, programs get ro cwd

crates/servers/storage-server/src/tests/protocol.rs

@@ -16,6 +16,15 @@ fn every_request_roundtrips() {
         StorageRequest::Create { path_len: 5 },
         StorageRequest::Delete { path_len: 5 },
         StorageRequest::Mkdir { path_len: 4 },
+        StorageRequest::Grant {
+            path_len: 4,
+            write: true,
+        },
+        StorageRequest::Grant {
+            path_len: 0,
+            write: false,
+        },
+        StorageRequest::Release,
     ] {
         assert_eq!(StorageRequest::decode(req.encode()), Some(req));
     }
@@ -35,6 +44,8 @@ fn every_response_roundtrips() {
         StorageResponse::Error,
         StorageResponse::ReadOnly,
         StorageResponse::NotAttached,
+        StorageResponse::Granted,
+        StorageResponse::Denied,
     ] {
         assert_eq!(StorageResponse::decode(resp.encode()), Some(resp));
     }