Mint a one-time protection-write capability (the CISO grant)

Issues a SINGLE-USE, short-lived (15-minute) capability authorizing ONE subsequent protection-card write for the caller + agent. The protection card is the 'locked door' surface, so its write is gated behind an explicit, operator-approved grant rather than a standing one (the alignment card, by contrast, is standing). The caller MUST be a human operator that org-co-manages the agent (ADR-062). A human is recognised by capability, not transport: session, JWT, API-key, and OAuth principals carrying the broad api:write user capability (an mcp:write grant, e.g. the CLI's mnemom login) may mint; an OAuth principal carrying only per-agent resource scopes (agent:<id>:<action>) is rejected — an agent can never mint its own protection grant. Idempotent: a re-mint within the window refreshes the single live grant. No token is returned — the capability is a server-side record keyed to the caller; the agent then publishes its protection card via its own connection and the server consumes the live grant on a successful write.