FLS1 — enabling field security through the real entity path succeeds, and the snapshot has
the right SHAPE: one row per (restrictable field × role holding entity read), none targeting
primary keys or _mj columns (test-plan 2.1). This is the check that catches the historical
"field security cannot be enabled on any entity" guard collision — so a fixture whose seed
is present but whose enable FAILED is a FAILURE here, never a skip.
FLS1 — enabling field security through the real entity path succeeds, and the snapshot has the right SHAPE: one row per (restrictable field × role holding entity read), none targeting primary keys or _mj columns (test-plan 2.1). This is the check that catches the historical "field security cannot be enabled on any entity" guard collision — so a fixture whose seed is present but whose enable FAILED is a FAILURE here, never a skip.