Grants: AI follows bench.rating.changed, Chat queries the Search Fabric, Design imports into Bench (#405)

ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex eb881070..66a1a65a 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -451,6 +451,8 @@ const DEFAULT_GRANTS = [
      // AI researches on the fabric (sf4-research): the fabric's query and the delegated subject query, so its web scope
      // counts against the person's own Search allowance and never reaches a provider with an account identifier.
      ['ai', 'search.query.delegate', 'openvibe.search', []],
++    ['ai', 'events.subscription.manage', 'openvibe.events', []],
++    ['chat', 'search.query.delegate', 'openvibe.search', []],
      ['ai', 'search.fabric.query', 'openvibe.search', []],
      // OpenVibe.Today (plan 2026-10-28 §5.3): today.event.* from its outbox, reminders as notifications to the person
      // who set them (resolved from their usr_ subject), and its live.stream.* and account subscriptions.
@@@ -613,6 +615,7 @@ const DEFAULT_GRANTS = [
      ['design', 'bench.round.read', 'openvibe.bench', []],
      ['design', 'bench.judgement.cast', 'openvibe.bench', []],
      ['design', 'bench.board.read', 'openvibe.bench', []],
++    ['design', 'bench.entry.create', 'openvibe.bench', []],
  ];
  
  // Grants withdrawn by decision; applied at every boot so an old default can't come back.
ddiff --git a/test/principals.test.js b/test/principals.test.js
iindex cc49dc95..285ef4c2 100644
---- a/test/principals.test.js
++++ b/test/principals.test.js
@@@ -162,10 +162,10 @@ const server = http.createServer(app);
      t = await token({ client_id: 'design', client_secret: 'design-secret', audience: 'openvibe.vision' });
      assert.strictEqual(t.status, 200, JSON.stringify(t.body));
      assert.strictEqual(t.body.scope, 'vision.ui.check', "Design's Arena runs Vision's UI check");
--    // OpenVibe.Design's Arena moves onto Bench (contracts 0.238.0): the five bench capabilities above, on openvibe.bench.
++    // OpenVibe.Design's Arena runs on Bench: the six bench capabilities above (entry.create for its importer), on openvibe.bench.
      t = await token({ client_id: 'design', client_secret: 'design-secret', audience: 'openvibe.bench' });
      assert.strictEqual(t.status, 200, JSON.stringify(t.body));
--    assert.deepStrictEqual(t.body.scope.split(' '), ['bench.board.read', 'bench.judgement.cast', 'bench.round.create', 'bench.round.read', 'bench.task.create'], "Design creates and reads Bench tasks and rounds, reads boards and casts judgements");
++    assert.deepStrictEqual(t.body.scope.split(' '), ['bench.board.read', 'bench.entry.create', 'bench.judgement.cast', 'bench.round.create', 'bench.round.read', 'bench.task.create'], "Design creates and reads Bench tasks and rounds, reads boards and casts judgements");
  
      // OpenVibe.Bench (contracts 0.238.0): the account export/deletion pair, its account-event subscriptions, and
      // ai.run.create (namespace ai.generate) to run its pinned rounds; it publishes bench.* events and indexes nothing.