Task: Keep sandboxes out of official reports

Make it impossible for an official report to read sandbox data, even by a forgotten filter.

• A report definition states whether it is official; existing definitions are official.
• An official definition's scope cannot name a sandbox portfolio or a virtual book, and a definition cannot become official while its scope does.
• The books an official report resolves never include a virtual book.

• Row-level security already hides a sandbox's portfolios and books from a session with no actor, so a system process sees none. That is not enough: the book resolver runs as the table owner, which bypasses row-level security, so the rule has to live in reporting itself.
• report_definition gains is_official, defaulting to true, so every existing definition stays official.
• The two scope tables refuse a virtual book or a sandbox portfolio when the configuration's definition is official.
• A definition cannot become official while one of its configurations scopes a sandbox input.
• The resolver drops virtual books from an official report's set, as a last line of defence for data written before these checks.
• A pgTAP test covers the rules the test user can reach.

Every number this task claims about a tree, with the command that produced it and the commit it was measured at. A number without both is not a measurement, because a clean-up record describes a tree and trunk moves under a branch: a consumer count, a gate's component count and a suite's size all change with no code changing, and the reader of a bare number cannot tell which tree it came from. Where the raw output matters, put it in an evidence/ file beside the task and name that file in the Command column.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

• report_definition.is_official is generated, defaulting to true in the C++ type and in the database; every existing definition is official.
• The risk report scope tables refuse a virtual book or a sandbox portfolio for an official report (23514), and a definition cannot become official while its scope holds one (23514).
• The book resolver drops virtual books from an official report's set.
• projects/ores.sql/test/reporting_official_reports_test.sql (pgTAP): 9 of 9 pass. The resolver's own filter is not reachable from the test user, because the scope and definition checks keep the state from arising; it stays as a guard for data written before them.
• Build clean; ctest 89 of 89 on a recreated database.