Canary test and route completeness tripwire for permission leaks

[bencap]

The acceptance test for the rest of the epic. It asserts on HTTP response bodies rather than internals, so it covers JSON, CSV, and NDJSON identically and is indifferent to where filtering ends up happening.

Build it first, against current behaviour, before any policy lands. Several of the assertions below fail on main today, which makes this the regression harness for the migration rather than a final gate, and it is what tells you the policies actually did something.

Scope

Seed a marked private entity of each guarded type, sweep every GET route as an unentitled caller, and assert the marker never appears in any response body.

• Assert on URN, not title. Titles are not always serialized, and the real leak in fix: Permission narrowing within entities #805 exposed thresholds rather than names.
• The persona matrix differs per entity. The owner-facing case needs "owns the parent, not the child" — a score set owner receiving a community private calibration owned by someone else.
• Prefer an explicit registry over auto-sweeping. ~105 GET routes, 58 with path params; auto-sweeping becomes a framework.

Assert on the payload, not just the parent entity

The six permission-aware entities are not the whole guarded set. variants and mapped_variants have no private column of their own, and they are where the leak in #808 §3a lives. The sweep must cover:

• A private score set's variant URNs, including from the ClinGen allele-search route (routers/variants.py:51), which reaches variants from arbitrary score sets with no parent boundary to guard them.
• A private score set's variant data. This is where the scores live, so it is the thing actually being protected.
• A private score set's mapped variants, from the GA4GH identifier lookup (routers/mapped_variant.py), which selects MappedVariant without touching scoresets at all.
• A private calibration's functional classifications, even when the parent score set is public.

Acceptance criteria

• Canary covers every guarded entity type and asserts the marker is absent from JSON, CSV, and NDJSON responses.
• Assertions are on URN and on marked payload values, not on title.
• Persona matrix includes the "owns the parent, not the child" case.
• A completeness tripwire fails when a GET route exists that is neither covered nor explicitly exempted with a written reason.
• The canary fails against a deliberately reverted fix from fix: Permission narrowing within entities #805 or Private score calibrations reach unentitled callers, and the narrowing idiom used to prevent it can delete rows #807, proving it detects the real thing.