proto becomes bxcore, the one shared crate (M5b task 00)

Done the way the owner asked and the spike mapped: the crate and the
manifests renamed, then what the build reported fixed. Layers: 138
"proto unresolved" errors across 169 files; cargo fmt reordering
imports; six fixture paths built as strings in brokerd's and bxctl's
tests, which the compiler cannot see, and comments naming
crates/proto/; the crate-dependency check and its self-test. One more
the spike did not reach: a `\nproto =` key inside a printf format in
the self-test, which a word-boundary replacement skips because `n` and
`p` are both word characters.

make gate: gate: ok, 944 tests; no new entry in /tmp.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

crates/bxcore/src/grant.rs

@@ -0,0 +1,50 @@
+//! Grant file schema. A grant is TOML written by the owner to allow one kind of tool call.
+
+use serde::{Deserialize, Serialize};
+
+use crate::{DataClass, Timestamp};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Mode {
+    Auto,
+    Ask,
+    Deny,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase", deny_unknown_fields)]
+pub struct Constraints {
+    #[serde(default)]
+    pub paths: Vec<String>,
+    #[serde(default)]
+    pub hosts: Vec<String>,
+    #[serde(default)]
+    pub patterns: Vec<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Grant {
+    pub tool: String,
+    pub mode: Mode,
+    pub max_taint: DataClass,
+    #[serde(default = "default_result_class")]
+    pub result_class: DataClass,
+    #[serde(default = "default_untrusted")]
+    pub untrusted: bool,
+    #[serde(default)]
+    pub expires: Option<Timestamp>,
+    #[serde(default)]
+    pub secret: Option<String>,
+    #[serde(default)]
+    pub constraints: Constraints,
+}
+
+fn default_result_class() -> DataClass {
+    DataClass::Private
+}
+
+fn default_untrusted() -> bool {
+    true
+}