The terminal's System screen grants an agent telemetry:read or takes it back with `g` and a confirm, as MCP `telemetry_grant` does #7348

Intent: who may read the machine's numbers is set where they are shown, and is never a silent default.

Done:

• [ ] On the System screen (src/tui/screens/system.ts), a forge admin presses g, picks an agent, and sees grant <agent> telemetry:read? y/n (or take back … when it has it); y calls setTelemetryGrant (src/actions/telemetry.ts).
• [ ] The screen lists the agents that hold the grant, in one line.
• [ ] Anyone the MCP tool refuses is refused in the same words and is not offered g.
• [ ] test/tui-system.test.ts gains a case that grants and takes back, and a refusal.

Files: src/tui/screens/system.ts, test/tui-system.test.ts. Risk: #7296 and #7321 also edit this screen; add a section below theirs.