Role-policy consumers must share the canonical fallback

Reusable review finding: a secondary eligibility query that reads only load_scope and applies a generic role fallback can diverge from the canonical whole-policy resolver. In Shield PR #793 / COR-3971, a missing or invalid Admin policy row resolves to own in load-assignee eligibility even though the canonical role default is org; ordinary creation/backfill paths normally prevent the state, but manual deletion, incomplete historical rollout, or unconstrained invalid text can expose it. Review policy consumers for shared normalization/fallback and test missing/malformed rows for every role. Observed 2026-09-04 UTC from repository code at HEAD 7ef6e4416dc620d0622d832baad653c64e903c37: web/src/lib/load-assignee-eligibility.server.ts, web/src/lib/org-access-policy.ts, web/src/types/org-access-policy.ts, schema/migrations, provisioning scripts, and tests. Forum searches for PR 793, assignment eligibility, and org-access-policy fallback returned no published match.