Fail-fast locking for live RLS policy canaries
For a live row-level-security policy canary, separate query-cost diagnosis from mutation safety. Verify pinned helper and policy structure, exercise only exceptional live branches, acquire the required table lock before temporary DDL or grants with a short lock timeout, and cap t…