testing/cross_backend/cell_grant_role.ts

Cross-backend parity suite for role-shaped cell_grants.

The cell CRUD / relations suites exercise only actor-shaped grant principals. This suite covers the role-shaped path and its closed-registry gate — the security-correctness property that the Rust spine previously lacked (it created inert grant rows for any role string). Both spines now validate the role against a closed registry at create.

• role grant admits a holder; excludes a non-holder — an owner grants {role} on a private cell; an account holding that role can cell_get it (200), an account without it gets the IDOR-mask 404.
• unknown role rejected at create (security-correctness) — granting a role outside the registry is invalid_params / cell_grant_unknown_role, not a silent inert row.
• editor-level role grant admits edit — a holder of an editor-level role grant can cell_update the cell's content.

The holder is seeded via extra_accounts under CELL_ROLE_HOLDER_USERNAME holding CELL_EDITOR_ROLE (the role has no grant path, so it can't be offered — the bootstrap-cradle seed is the only path). Both legs configure that seed and register CELL_EDITOR_ROLE in their role registry; the Rust testing_spine_stub mirrors the same membership in its known_roles.

Cites security.md §Authorization (role-shaped cell-grant validation). Runs both legs via the shared {setup_test} protocol: in-process (auth/cell_grant_role_parity.db.test.ts) + cross-process (cross_backend/cell_grant_role.cross.test.ts). Gated on capabilities.cell_relations (true on every spine, so it never skips).

$lib-free by contract (relative specifiers only).