This release:
- Cache restored Pubky grant sessions so concurrent SDK operations reuse one live bearer after restart.
- Revoke and confirm the current Pubky grant before secure sign-out clears local SDK state, including recovery from rotated bearers.
- Fail closed when revocation cannot be confirmed, when expiry is only inferred from the device clock, or when the active session belongs to another identity.
- Add explicit local-only
forgetSessionAccessrecovery for cases where remote revocation is unavailable.