RLS10 — DETERMINISTIC negative case: a user with NO read grant is served NO rows.
The seeded no-grant user (it-nogrant, no roles) has no permission on the seeded entity, so a live
RunView must return zero rows (fail-closed) — never leak the set to an unauthorized caller. This is
the deterministic replacement for the old incidental reliance on anonymous@magic-link.local.
Skips-as-pass when the seed is absent.
RLS10 — DETERMINISTIC negative case: a user with NO read grant is served NO rows. The seeded no-grant user (it-nogrant, no roles) has no permission on the seeded entity, so a live RunView must return zero rows (fail-closed) — never leak the set to an unauthorized caller. This is the deterministic replacement for the old incidental reliance on anonymous@magic-link.local. Skips-as-pass when the seed is absent.