feat(pat): add all-scope grant and safe single revoke

[shangguanxuan633-lab]

Summary

• add server-owned dws pat chmod --all planning and confirmed grant execution
• require explicit --yes before every non-dry-run PAT grant
• add safe single-scope --revoke; intentionally no batch revoke
• make PAT --dry-run an authenticated, one-attempt, side-effect-free server preview that can return missing permissions
• fail closed when the connected Gateway/Core does not attest the exact all-scope or revoke contract
• publish the composite CLI Schema for plan / grant / single revoke

User-facing behavior

• dws pat chmod --all --dry-run --format json asks the server for the complete actionable plan
• dws pat chmod --all --yes grants only the server-attested selectedScopes
• dws pat chmod <scope> --revoke --dry-run --format json previews one explicit grant
• dws pat chmod <scope> --revoke --yes revokes only that one ACTIVE explicit grant
• --dry-run --yes remains read-only
• all writes fail before the first service call when --yes is absent
• revoke never logs out, revokes OAuth, creates DENIED state, or falls back to a batch operation

Safety boundaries

• strict PAT preview performs exactly one allowed call: pat.batch_plan or pat.scope_revoke with dryRun=true
• no browser flow, polling, auth recovery, refresh, profile repair, credential migration, keychain mutation, identity creation, or authorization mutation on that path
• explicit --token does not load persisted credentials
• current-profile-only lookup cannot fall through to another organization/account
• server errors/challenges are emitted once and return nonzero exit code 4 without mutable recovery
• ordinary commands retain their existing token, plugin, identity-header, ClientID, recovery, and retry behavior

Scope / cleanliness

• current runtime candidate: 6a0acb6a331179b1773bddcb78e91b179672fc85 (the mergeable SHA will be regenerated after ci(schema): require base-owned migration approvals #679 merges and its one-shot manifest is consumed)
• one commit on current main@e69a1084
• 29 changed files before one-shot migration-manifest consumption
• no release/workflow/policy implementation, dependency, changelog, unrelated business feature, or historical merge commit
• 0 existing tests deleted or renamed; 69 tests added

Validation

• changed executable coverage: 100.0% (727/727) with COVERAGE_TARGET=100
• make test: 5 passed / 0 failed / 1 absent baseline suite skipped
• full go test ./...: pass on the same production tree
• go vet ./...: pass
• affected-package staticcheck: pass; repository-wide staticcheck still reports only pre-existing findings in unchanged files
• build, policy, generated drift, interface integrity, authoritative interface integrity, edition, skill, CLI smoke, and mock MCP smoke: pass
• independent qinze-style review on the exact tree: no P0/P1
• final race shards and package/E2E evidence will be appended before release sign-off

Server counterparts

Pre-production deployment is complete for the PAT-owned changes:

• Gateway release SHA: dda5b7a3f1c2d694e23eb31c4ad6819319182691 (PAT product tests 408 passed, 26 skipped; changed executable coverage 121/121)
• Core release SHA: bf1739541c236eb016ad46c0850705c64a65a408 (related tests 94/94; changed executable coverage 159/159)

The shared Gateway Aone order also contains unrelated CRs, so this PR does not claim global validation/sign-off for that entire shared order.

Merge order / hard gates

1. human-review and merge governance PR ci(schema): require base-owned migration approvals #679
2. rebase this PR onto the new main
3. delete the consumed one-shot approval manifest in this product PR
4. rerun all hosted CI, final pre-production package regression, DingTalk account/DB checks, and reviewer sign-off

The consumed manifest is under scripts/policy/**; therefore this PR ultimately needs a real maintainer ownership/adoption and CODEOWNER review. The AI policy must not be bypassed by removing labels without that ownership transition.

Supersedes #630, whose head is based on older main, contains historical merge noise, and is no longer the release candidate.