420 Attention permissions

Consent changes require the participant account or an exact account-scoped MANAGE_CONSENT capability. Reward claims require the canonical participant or an exact CLAIM_REWARD capability.

Sponsor campaign management and verifier proof submission are domain-scoped. Attention capabilities do not become governance, Bridge, validator, generic custody or unrestricted Smart Account authority.