testing/cross_backend/test_cell_gated_create_authorize.ts

Test CellCreateAuthorize policy mounted on both reference spines — the TS spine binary's full mount (full_spine_mount.ts) and the Rust testing_spine_stub — so the cross-backend cell_gated_create suite proves the parent-aware cell-creation authorizer agrees TS↔Rust. The twin of the Rust TestCellGatedCreateAuthorize, directory model.

Admin bypasses everything ({allow: true, moderation_required: false}). For a non-admin:

• Root creation (root_id null): kind: 'space' is admin-only (denied); every other parentless kind stays open, so the plain-create cell_crud / cell_relations suites are unaffected.
• Contribution (root_id set): the governing root's data.policy[kind] = {min_role?, moderation_required?} decides — a missing entry denies, a present min_role the actor lacks denies, and otherwise it admits with the entry's moderation_required folded into the verdict. The root's data arrives in input.root_data (the handler read it in-tx), so the predicate is pure — no DB read of its own (which also dodges the single-connection PGlite deadlock a separate handle would hit).

$lib-free by contract — reached by the spawned TS spine binary under Gro's loader (no $lib alias). Keep every import relative.