fix(authz): close fail-open db store defects from review round 1

C1/C2: grant() wrapped its delete+insert in db.tx on a shared,
unserialized sqlite connection, so a concurrent bare write from another
method (e.g. revokeRole) got swept into the open transaction and
discarded on rollback - a revoke could report success while the
privilege survived. Also broke concurrent grants on distinct keys
("cannot start a transaction within a transaction"). Replaced with
single-statement upserts (ON CONFLICT / ON DUPLICATE KEY UPDATE),
atomic without a transaction.

I1: assignRole's check-then-act SELECT lost 19/20 concurrent identical
calls to a UNIQUE violation; switched to ON CONFLICT DO NOTHING.

I2: an unrecognised `effect` value was dropped from both the grant and
deny buckets on read. Added a CHECK constraint and made anything not
literally "allow" count as a deny (fail closed).

I3: ensureAuthzTables defaulted to sqlite instead of the Db's own
dialect. I4: scopeKey now refuses an explicitly empty tenantId rather
than treating it as global (shared with the memory adapter). I5: added
migrations.test.ts asserting the generated DDL per dialect, including
MySQL's binary collation on identity columns. M1: DDL is now a
statement list instead of a blob split on a formatting-dependent
separator. M3: declared @wrnexus/db as a workspace dependency.

Extends the conformance suite with four concurrency/empty-scope tests
(23 total, up from 19) that all three adapters now pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/authz/src/store.ts

@@ -16,9 +16,21 @@ export interface PermissionStore {
   listSubjects(scope?: AuthzScope): Promise<string[]>;
 }
 
-/** Global assignments are stored under the empty-string scope key. */
+/**
+ * Global assignments are stored under the empty-string scope key. An OMITTED
+ * scope means global; an explicitly EMPTY tenantId is refused, because it is
+ * indistinguishable from global and would let a caller who controls the tenant
+ * id read and write global assignments.
+ */
 export function scopeKey(scope?: AuthzScope): string {
-  return scope?.tenantId ?? "";
+  const tenantId = scope?.tenantId;
+  if (tenantId === undefined) return "";
+  if (tenantId === "") {
+    throw new Error(
+      "WRN-AUTHZ-SCOPE: tenantId must not be empty; omit the scope for a global assignment.",
+    );
+  }
+  return tenantId;
 }
 
 interface Row {