acl: Phase 2 inheritance (groups, resource trees, roles) + 30 tests

eff_grant/eff_deny derived relations inherit through member_of (group +
role membership) and child_of (resource hierarchy); role_grant confers
role capabilities. Deny-overrides via stratified negation, deny
authoritative across the inheritance closure. Cyclic membership
terminates. Phase 1 suite unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/acl/facts.sx

@@ -2,7 +2,10 @@
 ;;
 ;; Each constructor returns a Datalog fact tuple (a list whose head is the
 ;; predicate symbol). These are the only shapes lib/acl/engine.sx feeds to
-;; lib/datalog/. Phase 1 covers actor/resource/grant/deny.
+;; lib/datalog/.
+;;   Phase 1: actor/resource/grant/deny.
+;;   Phase 2: member_of (subject -> group/role), child_of (resource -> parent),
+;;            role_grant (role -> action,resource capability).
 
 (define acl-actor (fn (id kind) (list (quote actor) id kind)))
 
@@ -11,3 +14,14 @@
 (define acl-grant (fn (subj act res) (list (quote grant) subj act res)))
 
 (define acl-deny (fn (subj act res) (list (quote deny) subj act res)))
+
+;; subject S is a member of group/role G (one hop; transitivity is derived).
+(define acl-member-of (fn (subj grp) (list (quote member_of) subj grp)))
+
+;; resource R is a child of parent P (one hop; transitivity is derived).
+(define acl-child-of (fn (res parent) (list (quote child_of) res parent)))
+
+;; role confers capability (act on res) to every member of the role.
+(define
+  acl-role-grant
+  (fn (role act res) (list (quote role_grant) role act res)))