KF1 — key-filter isolation (deterministic, no DB read).
Two clones of the SEEDED scoped user — identical roles, identical everything — differ ONLY
in APIKeyRowFilters. Their effective clauses MUST differ, and the bound clone's clause must
carry the key term AND-composed with the role term: AND is what makes "a key can be LESS
than its owner" true — OR-composition would let the key layer WIDEN role RLS.
Skips-as-pass when the seed is absent or metadata lacks a usable distinct filter.
KF1 — key-filter isolation (deterministic, no DB read). Two clones of the SEEDED scoped user — identical roles, identical everything — differ ONLY in APIKeyRowFilters. Their effective clauses MUST differ, and the bound clone's clause must carry the key term AND-composed with the role term: AND is what makes "a key can be LESS than its owner" true — OR-composition would let the key layer WIDEN role RLS. Skips-as-pass when the seed is absent or metadata lacks a usable distinct filter.