fix(page-data): grant agent role set permission

mindspace-userdata-postgres.test.mjs

@@ -5,6 +5,7 @@ import path from 'node:path';
 import test from 'node:test';
 import {
   buildControlSchemaSql,
+  buildEnsureCurrentUserCanSetRoleSql,
   buildPostgresTableSql,
   buildPostgresCheckSql,
   buildPostgresForeignKeySql,
@@ -44,12 +45,21 @@ test('provision SQL creates isolated no-login roles and safety limits', () => {
   assert.match(sql, /CREATE ROLE "ms_u_ecc1c649fff7_owner" NOLOGIN/);
   assert.match(sql, /CREATE ROLE "ms_u_ecc1c649fff7_agent" NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE/);
   assert.match(sql, /pg_auth_members/);
+  assert.match(sql, /r\.rolname = 'ms_u_ecc1c649fff7_agent'.*am\.set_option/s);
+  assert.match(sql, /GRANT %I TO %I WITH INHERIT FALSE, SET TRUE/);
   assert.match(sql, /REVOKE ALL ON SCHEMA "u_ecc1c649fff74361a243a69b460cc407" FROM PUBLIC/);
   assert.match(sql, /statement_timeout = '30s'/);
   assert.match(sql, /NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION/);
   assert.doesNotMatch(sql, /temp_file_limit/);
 });
 
+test('agent role reconciliation requires SET without inherited privileges', () => {
+  const sql = buildEnsureCurrentUserCanSetRoleSql('ms_u_ecc1c649fff7_agent');
+  assert.match(sql, /m\.rolname = CURRENT_USER AND am\.set_option/);
+  assert.match(sql, /WITH INHERIT FALSE, SET TRUE/);
+  assert.doesNotMatch(sql, /WITH INHERIT TRUE/);
+});
+
 test('SQLite types and defaults map to conservative PostgreSQL equivalents', () => {
   assert.equal(mapSqliteTypeToPostgres({ type: 'INTEGER', pk: 1 }), 'bigint GENERATED BY DEFAULT AS IDENTITY');
   assert.equal(mapSqliteTypeToPostgres({ type: 'REAL', pk: 0 }), 'double precision');