fix(plugin-hono-server): drop seedEmail, update erasure ratchet baseline (#6334)

`AuthSessionApi.getSession` declares `user: { id?: string }` and nothing more,
so reading `email` off it is the #4127 shape. The canonical resolver reads
`sys_user.email` itself (the row it loads anyway for ai_seat), and that column
is unique by the auth invariant — same answer, no contract widening.

The erasure ratchet baseline drops its `current-user-endpoints.ts` entry: the
6 sites it recorded were the `as any` query options of the hand-copied table
reads this PR deletes (ratchet DOWN, as the gate itself instructs).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uFVNMmTxLpmfQYiuKM1Yx

Author: claude

packages/plugins/plugin-hono-server/src/current-user-endpoints.ts

@@ -517,10 +517,17 @@ export function makeExecutionContextResolver(ctx: CurrentUserEndpointsContext) {
             // construction: a missing engine or an absent table yields an
             // empty-but-valid envelope rather than an exception, so no read
             // here needs its own guard.
-            const grants = await resolveUserAuthzGrants(getObjectQL(), userId, {
-                tenantId,
-                seedEmail: session.user.email ? String(session.user.email) : undefined,
-            });
+            //
+            // No `seedEmail`: that option exists for a caller holding an email
+            // the resolver cannot read back (the API-key path, which has no
+            // session). Here the resolver's own `sys_user` read — the row it
+            // loads anyway for the `ai_seat` synthesis — answers it, and
+            // `sys_user.email` is unique by the auth invariant, so the two
+            // sources cannot disagree. `AuthSessionApi.getSession` declares
+            // `user: { id?: string }` and nothing more; reading an undeclared
+            // `email` off it through `any` is the #4127 shape, and widening
+            // that contract needs a call site that actually requires it.
+            const grants = await resolveUserAuthzGrants(getObjectQL(), userId, { tenantId });
             // [#2408 / #3361] Open the per-request `Server-Timing` disclosure
             // gate for an admin/service principal — the standalone-surface analog
             // of the runtime dispatcher's `timedResolveExecutionContext`. The rung

scripts/query-options-erasure-baseline.json

@@ -42,7 +42,6 @@
     "packages/plugins/plugin-approvals/src/lifecycle-hooks.ts": 4,
     "packages/plugins/plugin-auth/src/admin-import-users.ts": 1,
     "packages/plugins/plugin-auth/src/auth-manager.ts": 14,
-    "packages/plugins/plugin-hono-server/src/current-user-endpoints.ts": 6,
     "packages/plugins/plugin-sharing/src/share-link-routes.ts": 3,
     "packages/plugins/plugin-sharing/src/share-link-service.ts": 5,
     "packages/plugins/plugin-webhooks/src/bootstrap-declared-webhooks.ts": 1,