fix(tests): adopt projectcampus fixes — hierarchy seeding, fixture parity, flaky cleanup

[flipvh]

Adopts the verified fixes from the projectcampus contribution brief (a fork with a four-level channel hierarchy and draft-lifecycle products — it exercises paths cella's single-channel default config masks). All six claims were verified against main before adoption; every mechanical claim checked out.

The fixes

1. Flaky requests-test cleanup — the case-insensitivity test's uppercase row survived the exact-match afterEach delete and tripped the unique (lower(email), type) index on the next run: flaky only on persistent local databases, invisible in CI. Cleanup now deletes with lower() on both sides (one hardening beyond the brief: it stays correct if the fixture email ever changes case). Proven by the run-twice-same-DB gate.
2. Hierarchy seeders insert the full ancestor chain — TestChannelRow gains ancestorColumns (walked root-first, so every ancestor id is known), and both seeders (hierarchy-helpers.ts + the rls-security local copy) insert every ancestor id column instead of only the immediate parent. Deep hierarchies keep all ancestor columns NOT NULL, so grandchild seeding died at setup. Upstream-safe: with cella's default hierarchy the chain has length 1 and the generated SQL is unchanged — RLS suite 50/50 green here, 123/0 in the originating fork. The parent* fields stay for compatibility (now derivable as ancestorColumns[0] — flagged for a later cleanup).
3. RLS product fixtures publish draft-lifecycle rows — matching findUnseenCountsByUser's isNotNull(publishedAt) filter; inert for cella's attachment. One deviation from the brief worth noting: the brief's 'publishedAt' in table idiom turned out to be deliberately type-safe — the "more canonical" getColumns(table).publishedAt fails typecheck against cella's precise column types. Landed as 'publishedAt' in getColumns(table), which keeps both the column-accuracy and the type-check.
4. copilot-instructions: ContextEntityType → ChannelEntityType (dead since the 2026-07 channel rename).
5. get-valid-product comment: checkPermission → checkAccess.
6. views engine-parity test made config-independent (the brief's option (c)): passing undefined never exercised the no-elevatedRoles branch — JS default parameters substitute the app-config default on ANY undefined — so the test asserted ambient app config and necessarily failed in forks that configure elevatedRoles. It now asserts the same subtree semantics via an explicit elevatedRoles list containing the granted role, with a comment explaining why undefined cannot test that branch. The deeper contract question (empty array as canonical "none" + dropping the undefined branch) is filed separately — it needs coordination with the permission engine's isHomeScopedGrant semantics.

Verification

• pnpm check green (biome, full-repo typecheck, sdk unchanged).
• Requests test run twice against the same database: both green (the literal proof of fix 1).
• TEST_MODE=full rls-security: 50/50; attachment-seq-reads (the other hierarchy-plan consumer): green; realtime views: green.

Fork-facing note: raak consumes the shared testing infrastructure (items 2+3) — auto-migrating, no codemod needed; the changes are additive and byte-stable for any depth-≤2 hierarchy.

🤖 Generated with Claude Code