test(provisioner): multi-tenant deprovision-scoping regression (truehomie DROP-incident class)

[mastermanas805]

What

Adds a real-Postgres + real-Redis integration regression test for the
2026-06-03 truehomie-db DROP incident class: prove that deprovisioning
tenant A drops ONLY A's database+role (postgres) / ACL user+keys (redis) and
leaves a co-resident tenant B fully intact.

Why #45 didn't cover this

PR #45 (server_live_roundtrip_test.go) proved single-tenant
Provision→Regrade→Deprovision→re-Deprovision round-trips through the real gRPC
handlers for postgres + redis, including DROP-IF-EXISTS idempotency. It does
not prove scoping — that a deprovision is confined to its target tenant.
The truehomie incident was an unscoped/over-broad DROP taking out a neighbor;
that is precisely the assertion #45 lacked and this PR adds. No duplication of
the single-tenant idempotency path.

What this test does

server_multitenant_scoping_test.go provisions TWO co-resident tenants A+B
through the genuine server.ProvisionResource gRPC handler against a real
backend, seeds data into each (via each tenant's OWN returned ConnectionUrl
credentials), then DeprovisionResource(A) and asserts:

• Postgres (TestServer_Postgres_Deprovision_IsScopedToTargetTenant):
  A's db_/usr_ gone (DROP ran) AND B's database + role still exist, B's
  seeded row intact, B can still CONNECT with its own credentials.
• Redis (TestServer_Redis_Deprovision_IsScopedToTargetTenant):
  A's ACL user + namespace key reaped AND B's ACL user + key + value survive.

How tenant B survival was proven

Ran locally against real Postgres 16 + Redis 7 — both PASS. The postgres test
reconnects with tenant B's own ConnectionUrl after A's deprovision and reads
back the sentinel row, so it asserts connectivity + data integrity, not just
catalog presence. Skips clean under -short / no backend.

CI

Env-gated on TEST_POSTGRES_CUSTOMERS_URL + CUSTOMER_REDIS_URL (same env
resolution as #45). provisioner coverage.yml already provides pg+redis
services and runs go test ./... -p 1 without -short, so these tests
execute for real in the gating coverage job. No workflow changes needed.

Coverage block

Symptom:        unscoped DROP DATABASE/DROP USER (or ACL DELUSER/SCAN+DEL) on
                deprovision takes out a co-resident tenant (truehomie 2026-06-03)
Enumeration:    gRPC DeprovisionResource handler path, postgres+redis LocalBackend
Sites found:    2 (postgres deprovision, redis deprovision)
Sites touched:  2 (both have a co-resident-survival regression test)
Coverage test:  TestServer_{Postgres,Redis}_Deprovision_IsScopedToTargetTenant
Live verified:  PASS vs local Postgres 16 + Redis 7 (real backends); B survives A

Integration-coverage delta (§1.4 Mechanism C): server-package statement % is
unchanged (19.9%) because the new tests exercise the same Deprovision handler
lines #45 already covers — the new value is a flow-completeness / behavioral
isolation guarantee (Decision 1A), not new lines.

🤖 Generated with Claude Code