Enforce subscription authorization for false-mode tables

[kriszyp]

Summary

• preserve the HarperDB 4.7 / Harper 5.1 loadAsInstance === false authorization contract: the shared Resource wrapper still skips false mode, so custom handlers continue to own their authorization
• add the missing one-time allowRead check inside the built-in Table.subscribe; connect funnels through the same checked path
• keep false-mode search request-scoped instead of applying the 5.2 per-record allowRead filter
• disable per-event allowRead filtering in false mode, including when a stale rowLevelAuthChecked marker is supplied
• fail closed when false-mode synchronous search receives a thenable allowRead verdict, which it cannot await
• preserve all loadAsInstance !== false record-scoped read behavior and the existing unchecked internal paths

Compatibility model

Historical false mode deliberately skips the wrapper-level allow* gate. Built-in Table methods perform their own one-time checks, while custom handlers are responsible for authorization. This PR fills the missing built-in subscription check without moving authorization into the wrapper or changing QUERY argument routing.

For a normal collection subscription, allowRead runs once on the collection receiver. A targeted subscription retains the historical target receiver; the PR does not synthesize a different resource instance. No false-mode read is rechecked per record or per event.

loadAsInstance !== false retains the existing 5.2 behavior: synchronous application overrides may be evaluated per row/per event.

The narrow v5.1 backport is #1914.

Compatibility audit

• HarperDB 4.7.36 and Harper 5.1.23 both skip wrapper-level allow* when loadAsInstance=false; built-in Table methods own one-time authorization
• central-manager currently targets HarperDB 4.7 and contains custom false-mode handlers with their own authorization, so a new wrapper gate would be a compatibility regression
• host-manager does not use Resource/loadAsInstance handlers

Validation

• npm run build
• oxlint on changed production/tests
• Prettier and git diff --check
• focused compatibility/read suite: 8 passing
• full core unit suite: 3,799 passing, 188 pending
• full resource unit suite: 1,259 passing, 14 pending
• prior full integration run: 1,572 passing, 0 assertion failures, 17 skipped; nonzero only because the optional real-Ollama fixture hit the existing Node ERR_IMPORT_ATTRIBUTE_MISSING startup issue and cancelled its six children

Review

Thorough cross-model review plus a final post-fix artifact review found no remaining blockers or significant concerns. Review caught and fixed the false-mode async-search truthiness bypass; the final guard is false-mode-only and does not change instance-mode behavior.

Generated with GPT-5.6 Codex.

[gemini-code-assist]

Code Review

This pull request updates the transactional logic in resources/Resource.ts to ensure that table subscriptions still enforce connection grants and row-level delivery markers when opting out of instance loading (loadAsInstance = false). It also adds comprehensive unit tests to verify this behavior. The review feedback suggests replacing a fixed setTimeout in the new tests with a condition-wait helper to prevent potential test flakiness in slower environments.

[claude]

Reviewed; no blockers found.