VENUS-365 — approveAccessRequestAttach threw on every non-alumno attach: alumnos has no id column

PROD BLOCKER, found via SELECT * FROM "vAppErrorsRecent" while Elazar was approving SOL-VENUS-13. appEvents action=approveAccessRequestAttachFailed, errorStack `column "id" does not exist`, 2026-08-07 14:33 UTC, requestId b0bb4d5d, linkedUserId aa3638ea. Cause: alumnos has NO id column — PK is userId. users/userRoles/cohorts/accessRequests/appEvents all DO have id, which is why the assumption slipped. The alumnos-shape compatibility guard in approveAccessRequestAttach selected "id" from alumnos, so it THREW instead of guarding. The guard never fail-closed — it crashed, and a crash is indistinguishable from the guard firing: both roll back and both deny, and the UI renders the same "No pudimos vincular la cuenta." for either. Its own branch has never executed. Introduced f84384e (2026-07-20, VENUS-293); runs only when grantedRole != alumno_postgrado AND an attach target exists, and venus has had exactly ONE non-alumno request in its history (SOL-VENUS-13), so nothing reached it for 18 days. Blast radius measured: 1 failure event total, 0 successful non-alumno approvals, no corrupt rows (transaction rolled back). Fix: SELECT "userId", type param widened to match. Predicate, LIMIT, rows[0] test, ROLLBACK and denial string unchanged. Sole occurrence tree-wide. Class-A. audit-venus-ca PASS pre-push (audit-venus-ca-msj1trme3wr4).