fix(dwn): revalidate records subscription authority

[LiranCohen]

Summary

• retain the dynamic authority proven when RecordsSubscribe opens
• re-fetch referenced target grants before each event so deletion, revocation, and expiry stop delivery; embedded author-delegate grants remain portable and are revalidated without requiring their source record locally
• retain the protocol role resolved under the signed subscription policy and perform only the indexed current-role-record lookup during delivery
• preserve direct-grant precedence, require combined author-delegate + target grants conjunctively, and classify temporary clock skew as retryable
• close before notifying application code and emit one typed terminal error through the existing FIFO delivery guard

Protocol policy remains pinned to the signed subscription timestamp. A later protocol reconfiguration does not reinterpret an already-authorized request; current role membership is still checked for every matching event.

Test plan

• focused RecordsSubscribeHandler suite (48 passing)
• Records Query/Count regression slice (87 passing)
• delivery authorization and cross-protocol role slice (17 passing)
• cursor catch-up regression: event, authorization loss, terminal-before-reply, no EOSE, late handle closed
• bun run lint (18 packages)
• bun run --filter @enbox/dwn-sdk-js build
• bun run --filter @enbox/agent build

[LiranCohen]

Addressed the validated review findings in e741b7f0:

1. Referenced target grants are now re-fetched for every matching event, so deleting the grant terminates delivery with RecordsSubscribeDeliveryAuthorizationFailed. Embedded author-delegate grants remain portable and are not made dependent on their source record being stored at the target DWN.
2. Role delivery no longer re-runs temporal protocol-definition resolution. Open-time authorization returns the resolved role-record selector; delivery performs only the indexed current membership lookup. This keeps immediate role removal without a TTL window or Level migration.
3. Cursor catch-up now has a regression covering one delivered event, authority loss on the next event, terminal notification before the 200 reply, suppressed EOSE, and late-handle closure.
4. GrantAuthorizationGrantNotYetActive maps to retryable RecordsSubscribeDeliveryFailed; revoked, expired, deleted, and missing authority remain non-retryable.
5. RecordsSubscribeProjectionFailed is now a typed DwnErrorCode.

The stale subscription Q&A was updated. The two pre-existing neighboring gaps are tracked separately as #1474 and #1475.

Targeted verification: 48 RecordsSubscribe tests, 87 Records Query/Count tests, 17 delivery/cross-protocol tests, root lint, DWN SDK build, and Agent build are green. Full matrix is running in CI.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.1% Duplication on New Code

See analysis details on SonarQube Cloud