feat(node-type-registry): add table_provision to BlueprintMembershipType

[pyramation]

Summary

Mirrors the table_provision override added to entity_type_provision in constructive-db PR #824 at the TypeScript-blueprint layer.

• Adds a new BlueprintEntityTableProvision interface with use_rls?, nodes?, fields?, grant_privileges?, grant_roles?, policies? — same vocabulary as BlueprintTable / secure_table_provision.
• Adds table_provision?: BlueprintEntityTableProvision to BlueprintMembershipType.
• Refreshes JSDoc on is_visible (now gates one of five default policies; no-op when table_provision is supplied) and skip_entity_policies (escape hatch for zero policies).
• Updates only graphql/node-type-registry/src/codegen/generate-types.ts (the AST-based generator); the checked-in blueprint-types.generated.ts was produced by pnpm generate:types.

Client-side only — these types exist purely for autocomplete/typechecking when authoring blueprint JSON. Runtime validation lives in metaschema_modules_public.validate_blueprint_definition() on the database side.

Review & Testing Checklist for Human

• Shape matches the SQL validator exactly. The SQL side (constructive-db PR feat: add @pgpmjs/migrate-client workspace package for typed Migrate API access #824) accepts policies[], nodes[], fields[], grant_privileges[], grant_roles[], use_rls on the table_provision object. Confirm the TS types don't drift (note: grant_privileges, not grants — this differs from BlueprintTable, which uses grants).
• Decision matrix in the JSDoc matches PR feat: add @pgpmjs/migrate-client workspace package for typed Migrate API access #824 semantics. table_provision=NULL → 5 defaults (gated by is_visible); table_provision object → caller's policies[] only, is_visible no-op; skip_entity_policies=true + NULL → 0 policies.
• Codegen round-trip. The generated file was produced locally; confirm pnpm --filter node-type-registry generate:types on your machine produces the same output (no drift vs. the committed .generated.ts).

Test plan

1. cd graphql/node-type-registry && pnpm generate:types — should be a no-op diff.
2. pnpm build at repo root — passed locally; expect green in CI.
3. Sanity-check the generated BlueprintMembershipType has the new table_provision?: BlueprintEntityTableProvision and that BlueprintEntityTableProvision references BlueprintNode, BlueprintField, and BlueprintPolicy from the same file.

Notes

• grant_privileges is typed as unknown[] to match the existing grants: unknown[] convention on BlueprintTable. A tuple type ([string, string | string[]]) would be stricter but inconsistent with the rest of the blueprint surface; happy to tighten if you want.
• No consumer code changes required — table_provision is optional, so existing blueprints continue to typecheck unchanged.

Link to Devin session: https://app.devin.ai/sessions/6aad642053f844439cbdbb0ce928bc08
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring