Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

fix: always check org scope on roles, remove stale comment

Rohil pointed out that the previous check let custom roles created
for an org pass even if they weren't scoped to the org namespace.
Now we check schema.OrganizationNamespace scope first, before
deciding if the role is platform-wide or org-specific.

Also remove stale 'replacePolicy deletes...' comment on createPolicy.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>