test: prove root reconciler actor boundaries

[Joncallim]

Scope

Adds mandatory dedicated-login PostgreSQL negatives for the root reconciliation actor boundary.

• The entry case holds operation, generation, project, backend, and authority inputs valid while actor B attempts actor A’s next generation; it expects the entry ownership denial and unchanged protected fingerprints.
• The completion case creates actor A’s current context in the same backend and transaction, then invokes completion as actor B. It intentionally expects the generic stale-context denial and verifies rollback/no orphan context.

Important limitation

Completion is a composite context-identity proof, not an isolated operation-actor predicate proof. The production routine binds actor_id together with operation, backend, transaction, generation, and project before its later operation compare-and-set. Reordering that lookup just to emit an actor-specific error would disclose another actor’s live context, so this child preserves the non-disclosing failure order.

Validation

• bash -n scripts/ci/prove-migration-0027-root-reconciliation-negative.sh
• npm test -- --run __tests__/project-root-reconciliation.test.ts (20 passed)
• npm test
• npx eslint --max-warnings=0 __tests__/project-root-reconciliation.test.ts
• npx tsc --noEmit
• git diff --check

The live dedicated-role PostgreSQL proof remains mandatory Web CI coverage; the six-role URLs are unavailable locally.