Function createGrants

createGrants(options: GrantsOptions): KernlGrants
User-facing grants over kehto's ACL state.

The runtime ACL is restrictive (aclDefaultPolicy, D-020): an applet with no entry holds nothing. kernl grants the baseline domains plus what the user allowed, and revokes whatever the applet's entry holds beyond that, which covers a domain the user took back and an entry kept from an earlier posture. The per-identity record is persisted at kernl:grants:v1; the ACL itself is persisted by kehto. Blocking an applet blocks it in the ACL and empties its environment through createEnvironmentResolver.
Parameters
- options: GrantsOptions
  ACL container, storage and the live domain list.
Returns KernlGrants
The grants surface.
Example
```
const grants = createGrants({ acl: bridge.runtime.aclState, storage, availableDomains });
grants.allowDomain(identity, 'relay');
grants.get(identity)?.capabilities; // includes 'relay:read' and 'relay:write'
```