Use peer grants as the complete service policy

[myobie]

Summary

• Use each peer allow array as the complete shell and exec policy.
• Migrate legacy policy with the safe intersection of the old key and each peer grant.
• Write format 2 with generated rollback mirrors for a restored 0.2.5 binary.
• Hide old command flags and remove them from generated service definitions.
• Fail closed when a policy format or migration write fails during reload.

Migration safety

A false or missing legacy key removes its matching grant from each peer.
A true legacy key preserves only grants that the peer array already contains.
The migration reports every removed grant and its reason.

Format 2 readers ignore the generated mirrors as policy.
The mirrors equal whether any peer array contains the matching grant.
This preserves the same effective policy if the automatic updater restores 0.2.5.
The code comment permits mirror removal only when the actual rollback binary understands format 2.

Silber and Hetz already use format 2 with matching mirrors.
Both hosts passed doctor, two-way real exec, and a 0.2.5 no-op write proof.

Verification

• cargo check --all-targets
• cargo test --lib: 533 passed, 5 ignored
• cargo test --lib config::tests::: 61 passed
• cargo test --test local_slice: 31 passed
• cargo test --test shell: 14 passed
• cargo test --test provisioning: 12 passed

No release or deployment is part of this pull request.