feat: subscribe to audience and grant-key control records

[LiranCohen]

Problem

The live topology stream is scoped to the mesh network context. Root audience records and encryption-protocol grantKey records are outside that context. Delivery records have a dedicated stream, but independent audience changes currently rely on on-demand lookup/anti-entropy and GrantKeySet remains fixed for the delegate session.

Target design

• dedicated, authorization-tested subscriptions for relevant audience and recipient grantKey records
• stream coverage integrated into refresh health and repair barriers
• invalidate only opaque parsed outcomes and key-miss caches
• reproject the complete local raw baseline without a topology rebuild when key material changes
• atomically replace GrantKeySet and zeroize superseded private material
• retain safe fallback polling when a server cannot authorize the scoped stream

Acceptance criteria

• audience/grant-key changes become visible without restart or broad topology polling
• no full topology query is required for a key-only event when the raw baseline is complete
• transient/rate-limit failures retain last-good keys and honor backoff
• deleted/revoked keys cannot leave new records readable through stale key-set selection
• deterministic race tests cover subscription gaps, replacement, zeroization, and shutdown