Writer: open every namespace with its own genesis; close a key in every namespace held #151

Issue 8 of ledger/prd/namespace-independence-prd.md §6, opened on the principal's instruction (session ledger/sessions/2026-10-namespace-layout-authority.md).

Cites. PRD §3.2 (Authority records), §3.3 (Keys).

Size. M. Depends on. Issues 5 and 6.

Appendix C note. No.

Rulings carried. 47, 69.

What it builds. init --namespace opens every namespace as the first is opened today: its own genesis grant on its own external_ref mandate (required every time), its own root and accept roles, its own first policy, and the genesis holder's self-bound first binding. Author::join_genesis goes away. identity rotate and identity revoke close the key in every namespace the writer holds it in: one change-set per namespace, filed by one invocation, in one commit, each close with the same at. Protocol: LP-4.38, LP-6.34 (new); Appendix B row. The genesis_key.rs tests that open a later namespace through another namespace's key are rewritten as §3.11 lists; --without-key stays until issue 13. The step also carries the test that no agent identity and no non-interactive session can produce an acceptance or a key close.

Acceptance criteria (§4.1).

• AC-47 (third bullet). The close verb files one change-set per namespace in one commit, and the notice names a key closed in A and open in B (69).

Related open issue: #105 (part 2 of the key lifecycle across namespaces).