Granting an app a private destination in the terminal asks first: `g` names the app and destination, `y` grants #7961

Intent: a grant widens what an app may reach past the egress boundary, so a site admin sees what they are opening before it opens, and one stray key never does it.

Today src/tui/screens/egress.ts grants the destination under the cursor the moment g is pressed. x (revoke) narrows the boundary and stays one key.

Done looks like:

• [ ] g on a row that is not yet granted opens confirmScreen (from src/tui/screens/common.ts, yesNo: true) titled "Let <owner>/<name> reach <destination>?" with one body line: "The app's outbound traffic to it is allowed until you revoke it with x."
• [ ] y (or the Grant button) calls grantAppEgress and the toast says "<destination> is granted." as today; n or esc grants nothing.
• [ ] g on a row that is already granted grants nothing again and opens no confirm.
• [ ] test/tui-egress.test.ts: the site admin test presses y after g; a new test presses g then n and proves egressView still shows the row not granted. The new test fails without the change. The writer and repository-admin tests still pass unchanged.
• [ ] bun test test/tui-egress.test.ts passes.

Files: src/tui/screens/egress.ts, test/tui-egress.test.ts Risks: none beyond the screen; actions/egress_grants.ts keeps every rule. Brief: a builder who knows the terminal screens.