[RBAC PR 6] Enforce mutation grants for governed namespaces

[philipfweiss]

Tracking: #2234 (step 6).

Provisioning a governed namespace records its owner and deployer grants, but those grants do not restrict anyone else while the default policy is permissive. An unassigned caller can still mutate nodes inside the namespace, so the ownership boundary is not enforced.

This PR makes is_governed_boundary enforce explicit grants for mutations:

• WRITE, DELETE, and MANAGE require a matching grant on the boundary or its descendants.
• READ, EXECUTE, ungoverned namespaces, and the admin bypass keep their current behavior.
• Hard-deleting a governed root requires MANAGE, since deletion removes its policy marker.

The rule applies on upgrade to provisioned and creator-owned namespaces whose marker is already true. Legacy namespaces with a false marker remain unchanged until backfill and activation.

---

Verification:

Ran the in-memory HTTP app with DEFAULT_ACCESS_POLICY=permissive and no configured restrictive scopes. Provisioned example.metrics for owner group owners and service account deploy-bot, then checked these paths:

origin/main: outsider WRITE example.metrics.* -> allowed by permissive fallback
this PR:     outsider WRITE example.metrics.* -> denied by governed boundary
this PR:     deploy-bot WRITE example.metrics.* -> allowed by explicit grant
this PR:     deploy-bot hard-delete example.metrics -> 403
this PR:     outsider READ example.metrics.* -> allowed by permissive fallback
this PR:     outsider WRITE example.open.* -> allowed by permissive fallback

[netlify]

✅ Deploy Preview for thriving-cassata-78ae72 canceled.

Name	Link
🔨 Latest commit	010832b
🔍 Latest deploy log	https://app.netlify.com/projects/thriving-cassata-78ae72/deploys/6a9101c54b61fd000823ffdc