Sub-ticket of EVO-113 infra: policy-grade attribution separation for identity-mutating DB writes - archive owner role, limited non-owner app role, distinct human credentials · evolutiva