Pure Zod-based validator for federation grant scope objects per PRD §8.1. Independent of CA, DB, and NestJS wiring — those land in M2-06. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
