G22b, scoped by reading the signatures rather than guessing at them

G22b, scoped by reading the signatures rather than guessing at them The entry said "fifteen tenant-schema reads" as though they were one shape. They are not, and the difference decides how long this takes and where it can go wrong. Two of them need nothing: `derivatives::by_op_hash` and `auth::grants_for` already take `E: sqlx::PgExecutor<'e>`. The rest take `&PgPool` concretely, and one of those is not a read at all — `rights::effective` consults a cache and writes through on a miss, so it needs an executor that can write, and moving it inside the caller's transaction changes when that row becomes visible to anyone else. That is a decision to make deliberately rather than discover, because the rights verdict is the one answer in this handler that must not be subtly wrong. Recording it because the next session should start from the signatures rather than rediscovering them, and because "fifteen reads" made the work sound uniform when the awkward part is a single function with a cache in it.