Batch authorization graph snapshot in one SQL round trip (TC-735 dependency)

[samgbafa]

Change

Fetch authorization closure edges, delegations, abilities and revocations in one tagged SQL query; rebuild the snapshot in Rust. Capability validation, revocation rules and schema stay unchanged. This main-based PR is required before TC-735's pre-persist write-path PR #301.

The metadata joins use a planner-visible 65-node (64 valid + overflow sentinel) lookup relation. The full closure and edge budget checks remain separate; 64 nodes load completely and 65/66 fail closed. Ability rows have a canonical typed (resource, ability) order across databases. Allow/deny outcomes do not change; only the diagnostic reason when several caveats all reject may normalize from the former backend-dependent order. SDK/CLI do not assert that graph rejection text; existing node containment-vector codes test the separate containment helper.

Evidence

• Old-versus-new canonicalized complete snapshots on PG16, SQLite and isolated MySQL8, including chains, windows, facts, caveats, revocations, alias roots and 12 abilities per delegation. Overlapping caveats reject with the same diagnostic on all three; matching caveats still authorize. Closure boundaries 64/65/66 pass on all three (9/9 graph tests).
• Parameterized EXPLAIN (ANALYZE, BUFFERS), 100,000 unrelated delegations and ability rows: PG16 and prod PG18.6 both use delegation_pkey and idx_ability_delegation_ability index scans, shared hit=7 for the one-root query, no temporary spill; original Batch authorization graph snapshot in one SQL round trip (TC-735 dependency) #302 query scanned both whole tables and spilled. Local evidence: ~/scratch/tc-735/node302-review/fixed-pg{16,18}-100k-plan.log.
• PG-backed serialized core suite 409/409; strict all-target core Clippy; request wire-budget tests 3/3, sign-in 69, baseline KV put 34, KV get 16. Formatting check passed.
• The repository's older full MySQL migrator hits a pre-existing indexed-column length error; isolated auth-table fixture tests ran against real MySQL8. CI MySQL fixture remains environment-gated.

Coordination

TC-1149/#298 owner reviewed the earlier diff; its principal/alias closure helpers must survive rebase. Request fresh Astra and Miller review of 082393b. No merge or deployment requested.

[samgbafa]

APPROVE — TC-735

[samgbafa]

REQUEST_CHANGES: see TC-735

[samgbafa]

REQUEST_CHANGES — TC-735

[samgbafa]

APPROVE: see TC-735

[samgbafa]

APPROVE — TC-735