fix(auth): reject scoped capability re-rooting

[marcus-pousette]

Problem

A delegated capability was allowed to choose a different subtree root when the receiver's current ancestry said it was a descendant of the proof root. That ancestry can change as operations arrive, so different peers could disagree about whether the delegation was valid.

What changes

• A non-document-wide proof may delegate only at the same root.
• It may still narrow actions and time bounds, reduce maxDepth, or add exclusions.
• A document-wide proof may still delegate a narrower root.
• The mutable scope evaluator is no longer treated as authority for delegation.
• Scope evaluators remain available for read checks.

Fast paths

• Scoped delegation uses direct root and restriction comparisons with no tree lookup.
• Document-wide re-rooting remains supported.
• Same-root narrowing remains supported.

Tests

• same-root scoped delegation can narrow permissions
• scoped proofs cannot re-root even when current ancestry appears to allow it
• document-wide proofs can delegate a narrower root
• action, time, depth, and exclusion restrictions remain enforced

Stack

Stacked on #188.