Feature: rls_tenant_isolation

Emits alter table ... enable row level security plus a permissive tenant-isolation create policy ... as permissive for all using (tenant_id = ores_iam_current_tenant_id_fn()) with check (...) as a trailer of the entity's generated create SQL, and the matching drop policy at the top of the generated drop SQL. Row-level security is what actually enforces the tenant_id column the entity declares via :has_tenant_id:; the policy body is the verbatim dominant hand-written shape (T1) that previously lived per-component in *_rls_policies_create.sql files.

Omit on the deliberately-unisolated class of tenant-column tables (system-owned registries such as book_statuses, badge_mappings) that today carry RLS_001 ignore entries — this is an opt-in intent flag, never inferred from the presence of a tenant_id column.

None on the logical shape — no column or field is added or removed; only generated DDL policy blocks. Requires the entity's tenant_id column (:has_tenant_id:), and per-entity in-file emission is only legal for tables created after the iam section of create/create.sql (the policy resolves ores_iam_current_tenant_id_fn at creation time).

None yet — deliberately not fixed by any profile: a profile default would re-introduce inference for the skip class above.

• ORE Studio Variability Model — the bundle this feature belongs to.