Red-team tenant isolation (stretch)

Isolation has to hold in the database, with the scope taken from the authenticated session, because every layer above it can be talked out of it: a pooled connection remembers the last request, the owner role skips policies, and a model will pass whatever matter id a document tells it to. So the code keeps the broken versions next to the fixed ones and checks both: each "attack" check proves the leak is real, each "fix" check proves it's closed. The decision that matters most is scoping per transaction (set_config(..., true)), not per session.