Fail closed at the tenant request boundary

[yyyyaaa]

Context

Part 5 of 6 in the draft tenant-density stack: #1654 → #1655 → #1656 → #1657 → #1658 (this PR) → #1659. It integrates the lower-level runtime, cache, plugin, and exact-build contracts at the HTTP/WebSocket request boundary.

This layer makes the secure dedicated-instance design enforceable in the server. It does not treat an exact fingerprint as a sandbox, does not trust RLS to route schemas, and does not let routing labels select a cached tenant instance.

What changes

• Resolves and admits exact runtime credentials, database/API identity, physical schemas, request roles, and the Graphile build contract before publishing or using a resident instance.
• Rejects superuser, BYPASSRLS, CREATEROLE, CREATEDB, replication, unsafe inherited/SET ROLE paths, schema/object ownership, unapproved object privileges, SECURITY DEFINER, owner-rights views, foreign/materialized views, and unsafe stored-expression dependencies.
• Fails closed across HTTP and WebSocket admission, build-pressure 503 responses, pool/listener leases, shutdown, internal-request secrets, and the disabled-by-default administrative meta-schema header.
• Classifies protected CAPTCHA mutations from the selected GraphQL AST across supported body/transport forms instead of trusting a client-controlled operation label.
• Rechecks realtime events against the request role and preserves terminal response behavior when an admitted request is refused or retired.

Validation

• Frozen lockfile installation and builds passed for GraphQL query, server, server-test, and CLI.
• The full GraphQL server suite passed 399 tests with 2 skips across 38 passing suites and 1 skipped suite.
• Separate disposable PostgreSQL role-safety and checkout-sanitizer cases passed; Add tenant-density validation and production evidence #1659 carries the broader hostile A/B/C evidence.

Why this remains a draft

The audit found a genuine production blocker: route, RLS, auth, feature, CORS, public-key, and WebAuthn data are still read through separate statements without one immutable revision. Exact identities prevent arbitrary cross-tenant pool aliasing, but a handover/revocation can leave one in-flight HTTP request on an old snapshot, and an accepted WebSocket can retain stale authorization. Production needs an atomic TenantSecurityContractV1, generation retirement/socket revalidation, an authoritative per-API authRequired contract, and proof against disposable copies of the real production schemas.