chore(changeset): @objectstack/service-datasource patch; pin the outage class rather than its digits

Sized as #15365 was: a fail-closed bug fix, no accept set widens.

The outage arm now asserts the outage CLASS. Measured on this tree, the family
answers 500 INTERNAL_ERROR rather than the 503 SERVICE_UNAVAILABLE the brand
carries — a pre-existing relay gap this card did not open (the same escape has
existed for the `ql` permission-store outage since #13279) and does not repair.
Asserting the class keeps the pin on the security property.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ARYe3yQTQCUFm5qPYNgKaJ

Author: claude

.changeset/datasource-admin-tenancy-posture.md

@@ -0,0 +1,9 @@
+---
+'@objectstack/service-datasource': patch
+---
+
+The datasource admin routes derive the tenancy posture before resolving the caller
+
+`requireDatasourceAdmin` resolved the request with `resolveAuthzContext({ ql, headers, getSession })` and supplied no `tenancyPosture`. Both posture-conditional API-key refusals are gated on the caller supplying one — `organization_required` and `organization_membership_ended` — so neither ran on this family, and an API key stamped with an organization its owner had left was admitted; the routes then gated it on `authz.systemPermissions` alone. Because this family gates on system capabilities rather than on organization-scoped rows, the consequence was an admitted principal rather than a cross-organization row read.
+
+The posture is now read off the kernel's `tenancy` service and classified rather than swallowed: a service that was never registered stays quiet (`undefined` — the supported no-tenancy composition, unchanged behaviour), while one that was registered and failed to build raises `AuthzStoreUnavailableError` instead of degrading to "no posture". Patch rather than minor: no accept set widens, and a declared guard returns to enforced.

packages/services/service-datasource/src/__tests__/admin-routes-tenancy-posture-admission.test.ts

@@ -525,8 +525,19 @@ describe('[#15350] §5b — a `tenancy` service that was REGISTERED and FAILED i
     // The whole point of #13906 option A: a FAILURE must not read as "this
     // check does not apply". Whatever the transport renders, it is not the
     // 200 the ablation in §4 produces.
-    expect(res.status).not.toBe(200);
-    expect(res.status).toBeGreaterThanOrEqual(500);
+    //
+    // ⚠️ MEASURED on this tree, and deliberately not pinned tighter than the
+    // outage CLASS: this family answers `500 INTERNAL_ERROR` ("No response from
+    // handler"), not the `503 SERVICE_UNAVAILABLE` the brand carries. That is a
+    // PRE-EXISTING relay gap, not one this card opened — `requireDatasourceAdmin`
+    // has re-raised `AuthzStoreUnavailableError` for the identical `ql`
+    // permission-store outage since #13279, out of route handlers that have no
+    // `catch`, and the Hono adapter renders any escaped throw as a bare 500. It
+    // is filed separately. Asserting the class rather than the digits keeps this
+    // pin measuring the SECURITY property — the outage is never answered as an
+    // admission or as a capability denial — so repairing the status to 503 does
+    // not have to redden a security pin.
+    expect([500, 503]).toContain(res.status);
   });
 
   it('⛔ nor is a WRITE let through — nothing lands, read back from the store', async () => {