feat: reconcile granted ops run closes

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06bfe-2a55-7ed3-bacd-879977b099bf

src/activity_core/definition_parser.py

@@ -23,6 +23,10 @@ from activity_core.glas_profile import (
     require_harness_profile,
     validate_profile_ref,
 )
+from activity_core.repository_grant import (
+    RepositoryGrantError,
+    validate_repository_grant,
+)
 
 
 class ParseError(Exception):
@@ -122,6 +126,19 @@ def _validate_execution_declarations(
                 f"{location} execution_refs must be a YAML mapping",
             )
 
+        repository_grant = declaration.get("repository_grant")
+        if repository_grant is not None:
+            try:
+                declaration["repository_grant"] = validate_repository_grant(
+                    repository_grant
+                )
+            except RepositoryGrantError as exc:
+                raise ParseError(
+                    file,
+                    None,
+                    f"{location} has invalid repository_grant: {exc}",
+                ) from exc
+
 
 def _normalise_review_advisory(
     instructions: list[dict[str, Any]], file: Path