953a0a73bd
Prod smoke after per-scope rework: auth_log broke (22 mismatch). Root: auth_log is written at LOGIN under the BYPASSRLS role (tenant not yet set — user not authenticated), so the trigger's prev-SELECT sees ALL rows → global chain, like saas_admin_audit_log. Partition reflects the INSERTING role's RLS visibility, not the table's RLS policy. Reverted auth_log to global partition. Tests 7/7, pint clean.