feat(kbn): land KBN-101 Envelope A v6 (rc.20) — declarative sink-RBAC + RLS write-source (Form A)

Form A apply-in-place amendment of the frozen native-kanban SSOT, ratifying
the converged KBN-101 Envelope A v6 (rc.20): declarative sink-RBAC + per-role
connection-selection + RLS WITH CHECK/USING write-source + FORCE ROW LEVEL
SECURITY + sink-resident task_status_write_override table on `tasks`.

Contract-doc only — no code, no CI fixture, no KBN-100 file/row invention.

Files:
- KBN-101-DB-ROLE-SPLIT.md: §4 role table (+4 rung rows), role-table F2 note,
  §4 L176 CONNECT allowlist (+2 logins; "either"->"any of the three" + NB-5
  inline grants), §4 closing rc.20 block + frozen-invariant note, §5 secret
  matrix (+2 rung DSN rows), §7 manifest (+KBN-101-10 row, +,10 dep edges on
  -02/-03/-05/-06/-08, closing-sentence clause).
- SHARED-CONTRACT.md: rc.6 + rc.5 "Non-effect" pointer clauses; new
  ### 1.0.0-rc.20 changelog entry.
- MISSION-MANIFEST.md: §10 change-control audit-trail note.
- INDEX.md: index row for the ratified envelope doc.
- KBN-101-ENVELOPE-A.md (new): converged v6 envelope text, verbatim, marked
  RATIFIED / part of the frozen SSOT as of this PR.

Ratification lineage: Jason B1 ruling (2026-07-20T23:08Z) + Mos OPTION A +
Mos Q1 (TIER-LEVEL) + Mos Q2 (RLS WITH CHECK, two mandatory conditions) +
Gate A (a11a1e2c) + Gate B (a6aac2cd). HALT-clear per envelope §0-§1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

docs/native-kanban-sot/INDEX.md

@@ -12,6 +12,7 @@
 | [`MISSION-MANIFEST.md`](./MISSION-MANIFEST.md)                                                                 | Mission/authority boundaries, exact role chain, gate model, mandatory SecReview triggers, Certifier final/no-merge rule, and collision-free slice ownership                                                                                                                                                                                                                                                                                                                                                                                 |
 | [`TASKS.md`](./TASKS.md)                                                                                       | Dependency-ordered, bounded P0–P3 slices with IN/OUT scope, dependencies, shared contracts, file ownership, evidence, and USC coder2/3/4/5 parallelization                                                                                                                                                                                                                                                                                                                                                                                  |
 | [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md)                                                       | rc.16 direct-Drizzle current storage-wrapper hold: legacy N-1/uncertified/non-operative pending -02/-03/-06/-08; exact README commented/user-guide executable forms fail before masking and source-consistency rejects runner-delegation copy; held future bootstrap → TLS/roles → run → verify → readiness; plus prior production boundary, pgvector owner, attestation, inventory, manifests, DDL classifier, TLS/bootstrap, activation, and certification contract; foundation prerequisite of KBN-100 and real-role gate before KBN-105 |
+| [`KBN-101-ENVELOPE-A.md`](./KBN-101-ENVELOPE-A.md)                                                             | KBN-101 Envelope A (v6) — RATIFIED, part of the frozen SSOT: rc.20 declarative sink-RBAC + per-role connection-selection + RLS `WITH CHECK`/`USING` write-source + `FORCE ROW LEVEL SECURITY` + sink-resident `task_status_write_override`; adds owner card KBN-101-10 + responsibility-widenings; authority Jason B1 + Mos OPTION A/Q1/Q2                                                                                                                                                                             |
 | [`SHARED-CONTRACT.md`](./SHARED-CONTRACT.md)                                                                   | Remediated v1 integration contract: proof authority, exact failures/routes/DTOs/MCP ownership, concrete current-main field migration map, relational invariants, Coordinator split, recovery delivery                                                                                                                                                                                                                                                                                                                                       |
 | [`contracts/kanban-schema.v1.ts`](./contracts/kanban-schema.v1.ts)                                             | Drizzle target declarations including exact owner/principal membership, project congruence, tags/archive, proposals, persisted assignments, monotonic fences, durable retry, immutable evidence/audit                                                                                                                                                                                                                                                                                                                                       |
 | [`contracts/mechanical-coordinator.v1.ts`](./contracts/mechanical-coordinator.v1.ts)                           | Pure snapshot decision engine separated from persistence/service adapter; ID-bound approvals, bigint-safe fences, durable retry/quarantine, artifact-backed checkpoints, exact failures                                                                                                                                                                                                                                                                                                                                                     |