feat(grants): support SEMANTIC VIEW privileges (CREATE / SELECT ON ALL|FUTURE)

[GClunies]

What & Why

Semantic views are the backbone of Cortex Analyst / Snowflake Intelligence, but snowcap has no notion of them — grep -ri semantic snowcap/ returns nothing. The urgent gap is grants (the views themselves are often created by dbt): granting a role read access to semantic views in a schema requires manual SQL today.

GRANT CREATE SEMANTIC VIEW ON SCHEMA crexi.semantic TO ROLE data_engineer;
GRANT SELECT ON ALL SEMANTIC VIEWS IN SCHEMA crexi.semantic TO ROLE analyst;
GRANT SELECT ON FUTURE SEMANTIC VIEWS IN SCHEMA crexi.semantic TO ROLE analyst;

PR #18 added Cortex-adjacent privileges (USE AI FUNCTIONS, Cortex Search Service grants) — semantic views are the remaining piece for a full Cortex Analyst RBAC story in YAML.

Acceptance Criteria

• CREATE SEMANTIC VIEW added as a schema privilege
• on_all_semantic_views_in_schema: / on_future_semantic_views_in_schema: (and singular on_semantic_view:) grant keys work with SELECT / REFERENCES
• Fetch/plan round-trips these grants without spurious drift
• Docs updated (grant docs / snowflake-permissions page)

Resources

• Snowflake docs: semantic views overview, GRANT <privileges> for semantic views
• Snowcap: snowcap/privs.py, snowcap/resources/grant.py (no semantic view support today); PR Support Snowflake Cortex permissions: DRG fetch fix + USE AI FUNCTIONS + CORTEX SEARCH SERVICE grants #18 for prior art