Task: Read the fleet whole in the grid handler

latest_node_samples and the newest grid sample carry no tenant predicate, and a test proves a session the permission admits reads every node the installation reports. The work counts are stated as out of reach, with the capture that records why.

• compute_telemetry_repository::latest_node_samples carries no WHERE tenant_id = $1 and no parameter for it: the policy decides which rows the session reads.
• The newest grid sample comes from the generated repository and carries no tenant predicate through :tenant_read_scope: shared.
• A Catch2 test under projects/ores.compute/core/tests/ proves a session the permission admits reads every node the installation reports, and states honestly that a sample written under a third tenant is not visible.
• The work counts are stated as out of reach, and their ownership is recorded as superseded by story 84345A75 (the usage ledger) in the Result. This half is not implemented here.

(Implementation strategy. Written when work starts; key decisions are distilled into the parent story's * Decisions at close, but the plan itself stays — it is the historical record of what we did.)

Every number this task claims about a tree, with the command that produced it and the commit it was measured at. A number without both is not a measurement, because a clean-up record describes a tree and trunk moves under a branch: a consumer count, a gate's component count and a suite's size all change with no code changing, and the reader of a bare number cannot tell which tree it came from. Where the raw output matters, put it in an evidence/ file beside the task and name that file in the Command column.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

compute_telemetry_repository::latest_node_samples lost its WHERE tenant_id = $1 and the parameter it fed, so the per-node newest read states no tenant predicate and the row-level-security policy decides. The generated read_newest for the grid sample already lost its predicate through :tenant_read_scope: shared.

repository_compute_telemetry_repository_tests writes one node sample under the session's own tenant, one under the system tenant and one under a freshly provisioned third tenant, and proves latest_node_samples returns its own and the system tenant's nodes and not the third's. A second case proves the generated newest grid-sample read ignores a newer third-tenant row and returns a system row. The test uses the existing generators and states the policy's real admission – the session's own tenant plus the system tenant – rather than a wider claim.

The work-counts half of the story's acceptance is superseded by story 84345A75 (the usage ledger) and is not implemented here.

The full build is clean and all 94 test targets pass, including ores.compute.core.tests.