#3182 access grant create: a refused condition still leaves an empty grant-… definition and a failed run behind

Problem

When swamp access grant create is refused because of its condition, it still leaves an empty grant definition and a failed run record behind. Each refused attempt adds one more.

The action list is checked in the CLI before anything is written (src/cli/commands/access_helpers.ts:126), so an unknown action leaves nothing. The CEL condition is checked inside the grant model's create method (src/domain/models/access/grant_model.ts), which runs only after the CLI has saved the auto-definition. Any refusal raised there leaves:

• .swamp/auto-definitions/swamp/grant/grant-<hash>.yaml: type swamp/grant, no arguments, no methods;
• a status: failed run record and its log under .swamp/outputs/swamp/grant/create/.

The leftover never acts as a grant: swamp access grant list stays empty, and model list does not show it. It is clutter, not a security hole. swamp-club#3130 added another way to hit it, refusing a non-canonical modelType literal in a condition.

Reproduce

In a fresh swamp init repo:

swamp access grant create --subject user:adam --allow run --on 'model:@acme/deploy' --when 'tags.env =='
# Error: Invalid grant condition: CEL syntax error: Unexpected token: EOF   (exit 1)
ls .swamp/auto-definitions/swamp/grant/      # grant-<hash>.yaml
swamp access grant list --json               # []

So this predates #3130. The --server path (src/serve/handlers/access_handlers.ts) was not tested and may do the same on the server.

Expected

A refused grant create leaves the repository (and, through --server, the server) as it was: no new definition. Validate the condition and the selector before writing anything, as the action list already is, or remove the definition when create fails. Whether to keep the failed run record as history is part of the fix's decision; say which in the PR.

Acceptance

• Each refusal in the table leaves no grant-* definition, locally and through --server.
• A valid grant create still works and is listed.
• Regression tests in swamp. This changes no user path beyond nothing being left behind, so no UAT item is planned.