agent-grants: grant rows orphaned when an #agent/definition note is deleted

[unforced]

Found during 4b-2 cleanup.

When an agent's #agent/definition note is deleted (or its wants: shrinks), the agent module deregisters the agent but the corresponding rows in the hub's agent-grants.json persist forever (status stays pending/approved). Observed: a deleted grant-test def left a grant-test-vault-techne-read pending row behind.

Harmless for a pending row, but an approved row keeps a live minted token (vault) or stored secret (service/mcp) for an agent that no longer exists — a credential-hygiene gap.

Fix sketch: when the agent module removes a def (or a wants: entry disappears on reload), call a hub grant-delete for the now-absent connection keys. Needs a DELETE /admin/grants/<id> (module-auth) endpoint on the hub side (today there's only operator-gated revoke); deletion should also drop the minted token from the registry. Alternatively a periodic reconcile (module lists its live defs' wanted keys, hub prunes grants not in that set per agent).

Relates to the 4a/4b lifecycle. Cross-repo (hub endpoint + agent reconcile).

[unforced]

Slated for the error-handling hardening PR (PR #3). Companion audit quick-win: make grants.reconcileGrants failures on def-delete non-silent (today they log-and-continue, orphaning hub approvals — re-creating a same-named agent resurrects them). Will address + close via that PR.