Discover the RLS fixture: a two-user divergent-clause pair PLUS the two independent
single-user pieces (TokenFilter, LivePair). Pure (no singletons) so it is unit-testable
with a mocked provider + synthetic users. The two-user discovery iterates entities,
computes each user's clause once per entity (O(entities × users)), and returns the first
entity where two distinct users get different non-empty clauses. TokenFilter/LivePair are
attached to every returned fixture regardless of two-user usability, so the single-user
checks (RLS1/RLS5) run even when the DB lacks two divergent users.
Discover the RLS fixture: a two-user divergent-clause pair PLUS the two independent single-user pieces (TokenFilter, LivePair). Pure (no singletons) so it is unit-testable with a mocked provider + synthetic users. The two-user discovery iterates entities, computes each user's clause once per entity (O(entities × users)), and returns the first entity where two distinct users get different non-empty clauses. TokenFilter/LivePair are attached to every returned fixture regardless of two-user usability, so the single-user checks (RLS1/RLS5) run even when the DB lacks two divergent users.