Task: Implement Hotfix: the denial test counts on a caller without a role

Make the caller of the denial case hold nothing, so the read under test is refused for the reason the case states.

• The denial case holds a caller with no role assignment when it calls the read.
• ores.iam.core.tests passes.
• No production code changes.

account_role_repository::remove_all_for_account(caller.id) is called after the two accounts are written and before the service is constructed. The junction row is closed rather than deleted, and read_effective_permissions no longer sees it, so the caller reaches the gate holding nothing.

The account trigger gives Member to a person account at version 1 and never again, so an administrator can leave an account in exactly this state. The case is not asserting something unreachable.

The case failed with the outcome ok and a non-empty roles list, so the gate was never reached: the caller held iam::roles:read through Member.

Whether that is the right state is a separate question and is recorded in the story's decisions. This task changes the test only.

One call added to the denial case. ores.iam.core.tests passes and the suite is green again.