Stamp credential use grants from resolved bindings

[alexanderguy]

Summary

• The first grant commit stamps one system-origin credential:{id}/use grant for each resolved binding on the anchor, scoped to that binding's consumer. The same credential and consumer collapse to one grant, and an inference-only id is omitted.
• The commit waits while credential resolution is unrecorded. Mail to that workflow recipient stays held until a recorded settle. A failed settle leaves the hold until a later record or the idle hold TTL, and a redrive keeps the sender key bound when the mail was accepted. An HTTP trigger in that window returns 409 deployment_not_ready and does not enqueue.
• credentialBindings.package is the factory bundle id on a source-ref workflow and the pinned tool package's top-level manifest name otherwise. The grant's tool condition is tool: plus that value, so a spawned child keeps the grant when that condition matches the child cap's consumer.

Verification

• gmake all exits 0 on this branch: lint, the type check, the admin UI bundle, and the unit, workflow, and core suites pass.

Closes INTR-639

[alexanderguy]

Self-review (code-review skill) returned clean.

[linear]

INTR-639