[kcrmin]

Depends on #160. This branch is stacked on chore/revendor-canonical-baseline, so its re-vendor commit shows here until #160 merges.

Related: Idea2Strategy/Idea2Strategy-backend#298 narrows the grants in DatabaseAccessPolicy; merge it first.

What and why

• idea2strategy_trading held SELECT, INSERT, UPDATE and DELETE on every operations table, operator credentials and sessions included. The backend change limits it to what the trading worker executes: SELECT and INSERT on outbox_messages, SELECT, INSERT and UPDATE on outbox_consumer_receipts, INSERT on audit_events, and SELECT on audit_events.idempotency_key only (the on conflict arbiter needs it).
• db/canonical-baseline/R__database_runtime_grants.sql is the assembler output with that change; baseline.manifest and baseline.sha256 are regenerated. No other file in the baseline changes.
• Until now every worker test connected as the container owner, so nothing here could notice a missing grant. Four e2e tests now run the worker SQL through trading_runtime_probe, a login whose only membership is idea2strategy_trading; fixtures and assertions still run as the owner. BotControlIntegrationE2ETest runs the whole worker context that way.
• Known gap outside operations, not changed here: the BEFORE INSERT trigger on trading.orders calls identity.require_active_account, a SECURITY INVOKER function that locks identity.accounts FOR SHARE, and the trading role holds nothing in identity. The bot-control test grants that to the probe login only, never to the group role, so the grants under test stay as generated.

Verified

• Assembled the bundle with the backend branch at the root develop pins (backend 69dd804 plus the change, backtest a568df0, trading eb97bc3, data-pipeline d8bd3c0) through :db-migration:run. All nine V*.sql files are byte-identical to chore(schema): re-vendor the canonical baseline #160; only R__database_runtime_grants.sql differs, and the copy here is that output (6f96408c).
• The four e2e classes, 21 tests, pass under the probe login. With the receipt UPDATE and the audit column grant removed, all 21 fail with permission denied for table outbox_consumer_receipts or audit_events.
• ./gradlew check --rerun-tasks --no-daemon --no-build-cache with Docker (colima): BUILD SUCCESSFUL, 745 tests, 0 skipped, failed or errored.

Checklist

• The vendored grants are the assembler output, not hand-edited
• Worker SQL in four e2e tests runs as idea2strategy_trading only
• Removing a required grant fails those tests
• Root canonical_baseline_sha256 refresh follows the backend merge