Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

fix(store): review follow-ups on the policy, relation, and resource reads

The last-owner guard counted soft-deleted holders of the guarded role, so a
deleted owner policy would have let the last live owner be removed. The
locked CTE now counts live rows only, with a test that soft-deletes one of
the holders.

The lookups of organization, project, and group titles for the policy audit
record go back to the plain From. They only attribute the audit record, and
the trail must stay attributed after the parent is deleted.

The roles join in the policy list query only matches live roles.

The relation and resource tests list with no filter and compare counts, so
the check runs on real rows instead of an empty result.