acl: Phase 2 inheritance (groups, resource trees, roles) + 30 tests

eff_grant/eff_deny derived relations inherit through member_of (group +
role membership) and child_of (resource hierarchy); role_grant confers
role capabilities. Deny-overrides via stratified negation, deny
authoritative across the inheritance closure. Cyclic membership
terminates. Phase 1 suite unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/acl/scoreboard.json

@@ -1,10 +1,11 @@
 {
   "lang": "acl",
-  "total_passed": 24,
+  "total_passed": 54,
   "total_failed": 0,
-  "total": 24,
+  "total": 54,
   "suites": [
-    {"name":"direct","passed":24,"failed":0,"total":24}
+    {"name":"direct","passed":24,"failed":0,"total":24},
+    {"name":"inherit","passed":30,"failed":0,"total":30}
   ],
-  "generated": "2026-06-06T16:31:36+00:00"
+  "generated": "2026-06-06T16:35:53+00:00"
 }