Load grant files, failing closed on any invalid file

crates/brokerd/src/grants.rs reads grants/*.toml into a GrantSet: load reports every problem in every file and returns either a complete valid set or the full problem list, never a partial one; from_grants sorts by id and collects every rule-2..9 problem; render prints each problem then the runbook pointer. All 17 grants tests pass; make gate prints gate: ok.

Implemented-By: OpenCode session (model recorded in docs/implementer-log.md)

crates/brokerd/tests/fixtures/grants/one-bad/fetch-example.toml

@@ -0,0 +1,7 @@
+tool = "http_fetch"
+mode = "auto"
+max_taint = "private"
+result_class = "public"
+
+[constraints]
+hosts = ["example.com", "*.example.com"]

crates/brokerd/tests/fixtures/grants/one-bad/no-fetch-internal.toml

@@ -0,0 +1,7 @@
+# The owner meant `mode`. If this file were skipped, fetch-example would allow what it forbids.
+tool = "http_fetch"
+mdoe = "deny"
+max_taint = "secret"
+
+[constraints]
+hosts = ["internal.example.com"]

crates/brokerd/tests/fixtures/grants/one-bad/notes-read.toml

@@ -0,0 +1,10 @@
+# The owner's notes: only the owner writes them, so their content is trusted.
+tool = "read_file"
+mode = "auto"
+max_taint = "secret"
+result_class = "private"
+untrusted = false
+expires = "2027-01-01T00:00:00.000Z"
+
+[constraints]
+paths = ["/home/kyle/notes"]