Apply review findings to the Scoped Authorization Grant

[pepebndc]

Summary

This PR applies the findings of an independent two-model review (Claude and Codex) of #48 at a49fd3f. It targets feat/scoped-authorization-grant, so it can merge into #48 as one unit. Each finding is one commit.

The review found no critical, high, or medium defect. No commit changes the grant template or the guard logic. Two commits change doc comments in OpenZeppelin.ScopedAuthorizationGrantV1 (99bc9b0, 352c07b). The rest change documentation, one script comment, and tests.

Changes

Finding	Severity	Commit	Change
1	Low	99bc9b0	The README and the field docs state that the validity bounds apply to ledger time, and that a use can commit up to the synchronizer's tolerance outside the window in record time.
2	Info	c5fd492	The package README and the root README state the supported runtime (Canton 3.5) and the SDK 3.5 dependency.
3	Low	5da1fb0	The README states that a non-grantee actor gets a native fetch error when no consumer signatory is a grant stakeholder.
4	Low	352c07b	The README and the AuthorizationScope doc require epochs to increase and never be reused, and describe future-epoch grants.
5	Info	5db8098	The README states that the guard compares values and that controller authorization.actor is required.
6	Info	024ec09	The README documents the check order, and a test fixes it.
7	Info	93e305f	The README states that the error ID strings are the stable contract.
9	Info	60dd149	The treasury README states the confirmation and visibility cost of separate role authorities.
10	Info	463b7f1	The treasury README states that each stage checks only its own role.
11	Info	fd0f6c9	The test README states that OZ_LEDGER_PORT does not isolate parallel sandbox runs.
12	Info	db0694c	AGENTS.md lists the example and sandbox commands. The check-sandbox.sh comment names the suites that check time. The README marks external signing as untested.
Tests		45d8782	Library: failures that a consumer try/catch cannot catch, the native error for a non-grantee actor, microsecond window edges, epoch reuse and future epochs, a consumer signatory that supplies the grantee's authority, and cached disclosures after Revoke and Renounce.
Tests		6091989	Examples: pending treasury stages after a role revocation, a wrong permission under the correct authority, grant windows at proposal, and operator revocation in licensing.

Finding 8 (strict evaluation of the failure statuses) is not applied, because it changes production code for a small cost only.

Verification

dpm build --all
scripts/check.sh
scripts/check-lint.sh
scripts/check-coverage.sh
DAML_PACKAGE=test/scoped-authorization-grant-v1-test dpm test --all --show-coverage
DAML_PACKAGE=examples/licensing-app-v1-test dpm test --all --show-coverage
DAML_PACKAGE=examples/treasury-rbac-v1-test dpm test --all --show-coverage

All pass locally on SDK 3.5.8. I did not run the sandbox suites.

Caveats

• ScopedAuthorizationGrantV1EdgeTest.daml uses try/catch to show that a consumer cannot catch a guard failure. The build reports deprecation warnings for that module. A module pragma does not turn them off.
• These review tests are not added: sandbox time tests, Ledger API tests of ErrorInfo, external signing, different ledger and record times, multi-participant tests, an upgrade-check dry run, a Canton 3.4 runtime run, authority rotation in a consumer fixture, and a caught exception after a successful guard. Each needs a setup that Daml Script on the in-memory ledger does not provide, or a larger fixture.

🤖 Generated with Claude Code

[ericnordelo]

Thanks for creating @pepebndc. I applied the fixes manually on the main branch.