Introduce extends_grant_id on grants (models, CreateGrant param and SQL), add GetGrantLineage recursive query, and enforce same-org/immutability guards via migration triggers. Implement TransitionTarget.Extend with validation and an extend path that issues a chained grant + provision. Update docs, specs and tests accordingly.