Add workflow grant (UC2.5) design sketch for FGA WG discussion

[panyam]

A design sketch for a "workflow grant" pattern (referred to verbally in the meeting as "UC2.5") that sits between SEP-2643's UC2 (scope step-up) and UC3 (per-transaction RAR). Floated in the FGA WG meeting on 2026-05-06 and written up at the WG's request as a concrete document for review.

This PR is for discussion, not landing as-is. The doc is checked into examples/fine-grained-auth/ because that is the active workshop for the FGA implementation work. The natural long-term home is upstream as a SEP, either as additions to SEP-2643 or its own SEP. Happy to move it there if the WG agrees the direction is worth pursuing.

Inline review comments and concrete edit suggestions welcome. The Open questions section at the bottom of the doc lists what is explicitly known to be unresolved.

The doc covers:

• shape of the grant (custom RFC 9396 authorization details type, fixed minimal fields)
• end-to-end flow (RS originates the grant in the SEP-2643 denial, client echoes verbatim, AS signs)
• topology (MCP server as OAuth RS distinct from the downstream business service, both diagrammed)
• where this sits relative to UC2 and UC3, plus coexistence with the other proposals on the table
• where this would land in the flow if implemented
• what this deliberately does not do, and why