Add one-use host approval grants and an interactive replay proof

[aruintelligence]

Technical milestone

• Add optional consumeApproval to the host-owned action boundary and function-tool wrapper. It runs after exact digest approval and policy recheck, before the callback, and rechecks policy after an asynchronous claim.
• Provide a process-local short-lived grant store and runnable fixture: one call dispatches; reuse blocks with zero additional callbacks. The grant remains spent after an uncertain callback result.
• Test concurrent attempts, expiry, mismatched grants, and revocation during claim.

Visual proof

• Add a fifth Action Boundary Lab scenario that rehearses a one-use grant, shows SPENT after the first attempt, and blocks the replay.
• Add a code-native SVG explanation to the README and document the honest limits in the quickstart and breakthroughs page.

Verification

• Targeted Node tests for the boundary, wrapper, browser mirror, and new replay path passed locally.
• node pilots/action-boundary/one-shot-grant-demo.mjs produced one callback, then a blocked replay.
• HTML and JS syntax checks passed; SVG was rendered and visually inspected.

This remains a project-authored fixture. The local Map is not a durable distributed grant store, and neither the demo nor browser obtains authenticated human approval or sends a message.