Re-test inactive Terra grant refusal if either shared guard changes

Dependency invariant: today fn_guardGroupDeactivation refuses deactivating an active group with live grants, and the shared userGroups INSERT guard refuses granting an inactive group. Together they make inactive+granted unreachable through legal DML in both orders; the live inactive-refusal arm in the Terra membership core remains UNEXERCISED, while its g.isActive clause is defense in depth. If either shared guard is relaxed or removed, the inactive clause becomes load-bearing. Before such change applies, obtain owning-lane review and execute a live rollback-only inactive-grant refusal fixture with a named actor, exact residue manifest, and fresh zero-residue readback; do not suppress guards or mutate a real role group to manufacture evidence now. Parent TERRA-279 future-start and expired active-group arms are separate mandatory probes.