Function ApplyCloseoutTightenings

The tightenings the close-out server bundles apply on top of the shared fixture, all on non-system roles through the real entity path:

• Reader.Email → Deny: the reader's read-denied column.
• Denier.Title → Deny: the multi user's read-denied column, on an identity that can also create and update.
• Denier.Phone → Allow/Deny/Deny: readable but not writable for the multi user. Returns an error message, or null when every tightening saved.