fix(permissions): key runtime grant gate by canonical scoped widgetId (stops duplicate per-call consent popups after package update)