feat(dogfood): owner-isolated RLS fixture — hard, revert-provable #1994 gate - #2037

Why

The cross-owner RLS proof runner (src/rls.ts, from #2032) was unit-proven but had nothing live to exercise it. The harness boots single-tenant, so the org tenant_isolation policy is stripped and a fresh member falls back to member_default (broad read) — every object reports member-visible, so the #1994 invariant ("a user who cannot READ a record must not be able to WRITE it") never actually fired against an app.

Note: #2032's branch was removed before this work, so this PR also carries the #2032 runner commit (c3492faee) it builds on.

What

Two faithful ways to create real cross-owner isolation, both now live:

1. Owner-scoped fixture — the hard gate

test/rls-fixture.dogfood.test.ts + test/fixtures/rls-owner-fixture.ts: a one-object app (rls_note) whose member fallback permission set carries RLS.ownerPolicy('rls_note','created_by'). The predicate keys on created_by/current_user.id (not organization_id), so it survives single-tenant stripping — a fresh member genuinely can't read the admin's note.

• GREEN: owner policy on all ops → rls-consistent (the fix(security)[P0]: enforce RLS on by-id writes — close member-edits-others'-records hole (#1985) #1994 pre-image check denies the by-id write).
• AUTOMATED RED: a select-only variant → rls-hole on every CI run (read scoped, no write policy applies, by-id write lands) — the fix(security)[P0]: enforce RLS on by-id writes — close member-edits-others'-records hole (#1985) #1994 hole class reproduced at the policy layer. A gate that can't go red isn't a gate.
• MANUAL REVERT PROOF (documented in README): disabling the pre-image check in plugin-security flips the green fixture to GET 404 yet MUTATED it by id (PATCH 200). Verified, then restored.

2. Org-scoped / multi-tenant

test/rls-multitenant.dogfood.test.ts: bootDogfoodStack now takes { multiTenant: true }, registering plugin-org-scoping before SecurityPlugin so organization_id policies apply. CRM flips from every object member-visible (single-tenant) to 4 consistent / 0 holes / 0 member-visible — confirming the member-visible result was single-tenant RLS-stripping, not a broad-read default (the model real apps like hotcrm rely on). hotcrm isn't in this repo, so this validates against the in-repo CRM example and documents the path.

Harness

BootOptions gains security? (SecurityPlugin override for the fixture fallback) and multiTenant?. README documents both gates + the revert proof; the stale "next step" note in the single-tenant smoke now points at the two new tests.

Verification

• Full dogfood suite green: 43 passed, 1 skipped (pre-existing skip).
• Manual fix(security)[P0]: enforce RLS on by-id writes — close member-edits-others'-records hole (#1985) #1994 revert confirmed red, then restored.
• tsc --noEmit clean; @objectstack/spec import guard compliant.

🤖 Generated with Claude Code