Close T05: live matrix 12 pass / 0 fail / 3 skip

In-pod remote run. S08 needed UPDATE on secret_findings; granted and
recorded as migration 0005. Disruption scenarios remain operator-owned.

audit_core/postgres_backend.py

@@ -119,6 +119,21 @@ MIGRATIONS: list[tuple[str, str]] = [
         );
         """,
     ),
+    (
+        "0005-runtime-grants",
+        """
+        DO $grant$
+        BEGIN
+          IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'audit_core_app') THEN
+            EXECUTE 'GRANT SELECT, INSERT ON {schema}.events TO audit_core_app';
+            EXECUTE 'GRANT SELECT, INSERT ON {schema}.dead_letters TO audit_core_app';
+            EXECUTE 'GRANT SELECT, INSERT, UPDATE ON {schema}.secret_findings TO audit_core_app';
+            EXECUTE 'GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA {schema} TO audit_core_app';
+          END IF;
+        END
+        $grant$;
+        """,
+    ),
 ]
 
 # Rejection reasons whose payload must never be persisted — storing the body of