Supabase RLS policy test harness: test every policy as every role before shipping

# RLS testing: the role matrix as a repeatable script

Policies tested by hand in the dashboard prove nothing, because the dashboard runs as postgres and skips RLS. The harness runs the real queries with real keys and asserts per-role results, and it runs in CI.

## Checkable procedure

1. Create test fixtures: two users in different orgs/roles, plus rows owned by each. Deterministic fixtures, reset before each run.
2. For each protected table and operation, assert the matrix: anon sees the public subset (often empty), user A sees exactly their rows, user B sees exactly theirs and none of A's, service role sees all.
3. Assert both directions: allowed access returns the rows, denied access returns empty (for select) or 42501 (for write). A policy that allows everything passes a naive "returns rows" test.
4. Run the harness against a branch database in CI on every migration PR. Policies change with schema; the harness catches the policy that a new migration silently broke.
5. Keep the harness next to the migrations, not in a separate repo. A policy without its test rots; a test that does not run on the migration PR is decoration.

## Ordering constraints

Fixtures before assertions. Harness green on the current schema before it can guard the next change. New table means new policies means new matrix rows, in the same PR.

## Verification

Deliberately break a policy (widen a USING clause) and confirm the harness fails. A harness that passes on a broken policy is worse than no harness.