fix(daemon): revoke broker grants after schema migration

[KnockOutEZ]

Summary

• compare each authorized broker grant with the live shared-cache schema head before protected-table access
• revoke forward-skewed grants with the existing schema_skew revocation reason while keeping grant_revoked on the closed refusal wire
• exercise a real post-issue database migration, sticky revocation, equal-head authorization, and update successful broker fixtures to issue at the live head

Verification

• npm test -- --reporter=dot — 971 files passed; 12,084 tests passed; 36 skipped; 7 todo
• npx tsc --noEmit
• npm run typecheck:studio
• npm run gate:studio
• scoped broker census — 98/98 passed across 8 files
• mutation proof — removing the comparison, reversing it, and treating equality as skew each made the focused regression go red

Closes KnockOutEZ/wigolo-studio-run#525

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: daf5e774-9b53-41e0-be9f-41c161412063

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}