Durable permission-rule store (M3): DETS-backed, survives restarts.

Start under a supervisor with a file path:

{GenAI.Approval.Permission.Store.DETS,
 name: MyApp.PermissionStore, path: "/var/lib/myapp/permission_rules.dets"}

Then address it as {Store.DETS, MyApp.PermissionStore} in run options. Semantics match Store.ETS: :call-scoped rules are never persisted, subject/session filtering applies, expired {:until, _} rules are pruned lazily on read. Writes are followed by :dets.sync/1 so a crash cannot lose an always/block grant.

For multi-node or per-user rules shared across apps, implement the GenAI.Approval.Permission.Store behaviour over your own storage (e.g. a noizu_labs_entities entity) — this module is the single-node durable default.