Preserve issuer revocation across local authority rollback

[aruintelligence]

What changed

• Add an optional epochAnchor with atomic advanceEpoch and epoch-aware claimOnce methods on one independently held host store. A successful dispatch requires a new claim and an issuer epoch match in one transaction.
• Add revokeIssuerAnchored, which holds the local authority lock across the external epoch compare-and-advance and local write. The older synchronous revocation route refuses to run in this mode. Rejected or uncertain advances strand the lock for reconciliation.
• Reproduce rollback of an unspent grant, process restart, a new stale grant, a lost response after an external commit, and revocation/dispatch contention. Document the exact host contract and limits. The included file anchor is test-only.

Verification

• npm test: 992 passed.
• node scripts/check-package-artifact.mjs: 42 checks, no failures.
• npm run compatibility:consumer: passed.
• npm run check:links: passed.

Boundary

This rejects unspent stale grants after a local store rollback only when the external store is durable, linearizable, unchanged, and all local workers and revocation routes share the same local authority lock. It does not authenticate approvals, guard bypass paths, cover a rolled-back external store, provide a multi-machine handoff guarantee, or prove provider acceptance.