Align B→A consent:replication grant (src/ceg.rs) to locked CEG 1.0-RC29 §5.6.8.15 shape + revocation handling

[emooreatx]

CEG 1.0-RC29 (CIRISRegistry#98, §5.6.8.15) locked the consent:replication:v1 conformance shape. CIRISStatus is node B (the out-of-group monitor) on the B→A leg: it grants replication of health:liveness:v1 (RC20/#91) to the in-group CIRISServer lens node A, and registers A's key.

Align src/ceg.rs to the locked shape

• Emit the grant: dimension="consent:replication:v1", score>0, subject_key_ids=[A] (single peer), cohort_scope="federation", witness_relation="self" (REQUIRED).
• Payload-level (subject_kind:"consent_replication"): grants:"replication" + attestation_prefixes = JCS array sorted+deduped, e.g. ["health:liveness:"].
• Optional valid_until.

Bilateral pairing

B→A and A→B are independent unilateral grants; carry topical_relation: bilateral_pair so a consumer can confirm the peering is ratified (both present + live). This is the symmetric half of CIRISServer's A→B leg.

Revocation

On withdraws/recants of B's grant: cease replicating health:liveness: to A; partial narrowing MUST supersedes, never silent-drop.

Admission gate

Reuse the persist CIRISPersist#234 public register_federation_key for admitting A's rows — don't re-derive the gate.

Done = passes the CIRISConformance consent:replication:v1 vectors.

Refs: CEG 1.0-RC29 §5.6.8.15, CIRISRegistry#97/#98/#91, CIRISPersist#234.