nx_suite_share.nx

nx_suite_share.nx -- the family suite's sharing vocabulary (albums, contact cards, gifts) expressed ENTIRELY as tuples on nx_rebac, the estate's one authorization plane. This REPLACES nx_share_plane, which was a second implementation of a rule that already existed. WHAT THE CONVERGENCE PROOF DECIDED (nx_share_convergence_gate: 7 agree, 2 declared divergences, 0 silent): * the grant / revoke / check half was REDUNDANT -- both planes gave identical verdicts on every scenario that mattered, so it is retired here rather than maintained twice; * DIVERGENCE 1 (kept, deliberately): rebac lets anyone bootstrap the first grant on an OWNERLESS object. For family media that is too loose -- an album nobody has claimed should not be shareable by a passer-by -- so sg_grant REFUSES until someone has claimed it. This is a facade-level tightening of a plane rule, which is allowed; loosening one would not be. * DIVERGENCE 2 (migrated, not dropped): delegated re-sharing now rides the `curator` relation on the new `album` object type in rb_expand -- a rewrite-table ROW, i.e. data on the shared plane, instead of a capability bit in a private one. * the GIFT half was the only genuinely new capability, and it is here: a gift MOVES ownership (the giver stops being the owner) and the chain of holders stays recoverable from the append-only log via rb_list_subjects_history. No second history is kept, because keeping one is how the duplicate began. license_tier: ORIGINAL