File System Access: stale downgraded_read_paths escalation

Step 1. Click below and pick /tmp/fsa-poc-target.txt in the file picker. The page receives readwrite, stores the handle in IndexedDB, then calls handle.remove() (this populates downgraded_read_paths in the browser process).
1. Pick file → store in IDB → remove()

Step 2 (manual). Open the lock/tune icon → Site settings / Permissions and reset / revoke this origin's File System access (or run the chrome://settings revocation). This calls RevokeGrants() in the browser process — but it does not clear downgraded_read_paths.
After revoking, the server has already recreated the target file with content SECRET-CONTENT-WRITTEN-AFTER-REVOCATION.

Step 3. Click below. The page reloads the handle from IndexedDB (UserAction::kLoadFromStorage → fresh read grant at ASK), confirms read permission is prompt, then calls createWritable({mode:'exclusive', keepExistingData:true}). You will see a write-only prompt. Approve it. After writer.close(), the page queries read permission again and reads the file.
3. Load from IDB → createWritable → close() → read