test(visibility): prove the publication plane has no path to a private row

tests/visibility_live.rs is the connected proof, and its negative cases are as
much the deliverable as the feature. Every test builds a mixed corpus the real
way -- contract-valid EvidenceStatementV2 bytes in the accepted-evidence log,
projected by W2-BODY's own projector, then by both recall projectors -- with
four bodies whose envelopes differ: one approved triple, one approved for
visibility but not publication, one ordinary project row, and one fully
approved under a FOREIGN protection domain. Exactly one becomes
publication-safe.

The boundary is attacked three ways:

* Through the runtime. The private plane returns all four; the publication
  plane returns exactly the approved one, on both the lexical and dense lanes.
* Through the real database role. The test creates a login role, grants it
  CONNECT, schema USAGE, and the two views via the runtime's own
  publication_plane_grant_statements (asserting first that the surface names no
  base table), then connects AS that role over TLS and probes: SELECT,
  count(*), and LIMIT/OFFSET against every private table are all refused for
  lack of privilege, memory_body_objects_v1 is equally unreachable, and it
  cannot even CREATE VIEW over a base table to manufacture the path the grant
  withheld. What it can read is exactly the publication-safe population, and
  the private lexical text is absent from it.
* Through ranking. The private body repeats the query term six times and does
  outrank the public one on the private plane (asserted, so the fixture cannot
  silently stop being adversarial); asking the publication plane for LIMIT 1
  still returns the public row, which it could not if the class comparison ran
  after ranking. Count and offset probes are checked in the same test.

Two more negative cases:
* A body row with no memory_body_visibility_v1 companion -- the shape a
  pre-migration-0023 body has -- projects as private and is invisible to the
  publication plane while staying fully available privately.
* Re-admitting the same bytes under a private event collapses the recorded
  decision to private, and the projectors' end-of-pass reconciliation demotes
  the lexical AND dense rows that were already publication-safe.

Finally, the database's own CHECK is exercised directly: four unapproved
source-class pairs and an unknown class string are all refused, while the exact
approved pair is accepted -- the constraint restricts rather than forbids.

Gates (on a private crdb-up.sh instance, CockroachDB v26.2.3):
  cargo +1.94 test --locked --test visibility_live -- --nocapture
    6 passed; 0 failed
  cargo +1.94 test --locked --test recall_projection_live --test body_projection_live
    11 passed; 0 failed / 11 passed; 0 failed  (no regression from the
    additive column and the new visibility write)

Live test binary for the official lane: visibility_live.

Author: scottmeyer