[Feature Request] Standing-grant revocation dashboard

[cagdasyurekli]

Problem

OpenWorker\x27s "ladder of earned autonomy" lets one-off approvals graduate into session grants, standing automation rules, MCP per-tool trust, workspace trust, and egress/domain allows. Once granted, there is no single surface that shows what is live right now or lets a user revoke it. Revocation exists (overrides.py:revoke_trust, workspace_trust.py:set_trusted(False)) but is spread across multiple stores, has no explicit revoke flow for workspace trust, and trust changes are not audited.

Proposed Solution

1. Add a Settings -> "Active grants" view listing every live grant across: session grants, standing automation rules, MCP per-tool trust, workspace trust, and egress/domain allows — with which session or automation created each.
2. One-click revoke per grant, with the revoke event written to the audit trail (coworker/audit.py).
3. Give workspace trust an explicit revoke_trust() method mirroring overrides.py:revoke_trust.

Implementation Scope & Alignment

• Scope: ~200-300 lines (backend query/endpoints + a GUI panel).
• Zero New Dependencies: Uses existing stores and audit plumbing.
• Alignment: Directly reinforces "Governed by design" — the ladder of earned autonomy needs a working way to climb back down, and trust changes should be as visible and auditable as the grants themselves.