Story: Hotfix: the denial test counts on a caller without a role

Let the denial case of the account-access read exercise the refusal it describes, so the suite tests the authorization boundary rather than a state no account is in.

• The denial case calls the read with a caller that holds no role.
• ores.iam.core.tests passes.
• The production gate and its documented contract are unchanged.

• The production gate is not changed here. read_account_access refuses a caller without iam::roles:read, and its header states that contract precisely. This fix makes the test's caller genuinely lack the code rather than relaxing the contract.
• The boundary question is left open, deliberately. efe1543875 granted iam::roles:read to Member so a member can read the role catalogue, and the same code gates reading another account's access, so every member may now read any account's roles, permissions and assignment tail. That grant is argued for the catalogue and against account data in its own message, so the two readings are in conflict. Resolving it means giving the account-access read an entitlement members do not hold – iam::accounts:read is one – which changes production behaviour and the documented contract. It is a decision about the boundary, not a test fix, and it is not taken here.

• Whether a member should be able to read another account's access. See the second decision.

Done. The case takes back the Member assignment the account trigger gave the caller before calling the read, which is the state an administrator can leave an account in. ores.iam.core.tests passes: 771 assertions in 252 test cases.