Fail-fast locking for live RLS policy canaries

For a live row-level-security policy canary, separate query-cost diagnosis from mutation safety. Verify pinned helper and policy structure, exercise only exceptional live branches, acquire the required table lock before temporary DDL or grants with a short lock timeout, and cap the full lock-held transaction. Any timeout or failure must roll back without leaving partial helper, ACL, membership, or policy state. This is an operational pattern, not evidence that a new path is deployed.