Enable RLS on every guarded table #878

Summary

After the pilot, this issue turns RLS on for the rest of the guarded tables, in staging and then production, in one step.

Terms are defined in the glossary on #808.

Scope

• One migration runs ENABLE ROW LEVEL SECURITY on every table on Work out which tables need RLS policies, and what they'll cost #832's list not already enabled, and security_invoker = true is on every plain view.
• Empty the not-yet-enabled list in Fail CI and startup when RLS can be bypassed or isn't enforcing #824's module.
• The migration goes to staging first. It moves to production after 7 days in staging with a zero policy-gap count (Count where the Python read filters disagree with RLS #835) and no RLS errors in the logs.
• One step, not batches: the Python read filters stay through the soak, so enabling can hide rows but can't leak them.

Rollback

Per table, ALTER TABLE ... DISABLE ROW LEVEL SECURITY as mavedb_migrate, and put the table back on the not-yet-enabled list. Don't drop the policies. Rehearse on one table in staging before production.

Acceptance criteria

• In production, this returns no rows:

  SELECT c.relname FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
   WHERE n.nspname = 'public' AND c.relname = ANY (:guarded_tables) AND NOT c.relrowsecurity;

• The not-yet-enabled list is empty.

• The RLS checks pass in production.

• The rollback was rehearsed in staging.