typelayer: a role denied a generator-DEFAULT column has every record declined (chtypes v2) #816

Found on the chtypes v2 work for #712. It affects unreleased code only: the role-restricted ingest path in #712.

Problem. When a role may not write a column whose DEFAULT draws a random or generated value, every record that role ingests is declined.

Measured on the chtypes v2 dev SDK, library build 20261009.145808, with an overlay test through Table.IngestWith:

• Table: id UUID DEFAULT generateUUIDv4(), tenant String, v UInt32.
• Role: may write tenant, v only.
• Body: {"tenant":"a","v":1} {"tenant":"a","v":2}.
• Result: the batch is declined as a whole: batch outcome is 'unsupported': only a fully accepted batch exports bytes. On the API that is a 422 validation engine declined for every record.

Controls (same build):

• Same table with id writable by the role: accepted.
• Same table, no column restrictions: accepted, with generated ids.
• A denied ts DateTime64(3) DEFAULT now64(3) (a clock value, not a generator): accepted, ts omitted from the export.

Why. internal/typelayer/roletable.go builds a role's schema by re-declaring each column the role may not write as MATERIALIZED <its stored default> (storedDefault). That keeps every expression over it compiling, and stops a record from naming it. For id UUID DEFAULT generateUUIDv4() that gives id MATERIALIZED generateUUIDv4(). chtypes refuses a MATERIALIZED column that draws a random or generated value, because the server would draw its own at INSERT. So the role's whole batch comes back unsupported.

Who meets it. Any deployment where a role's insert permissions exclude a column with a generator DEFAULT (generateUUIDv4(), generateUUIDv7(), rand*(), generateSnowflakeID(), and similar). A server-assigned id UUID DEFAULT generateUUIDv4() is a common table shape.

Related: #712.