Close the last tenant-isolation adversarial probe (mid-provisioning tenants)

Phase 4 task 8's verification plan named four adversarial probes;
three were closed earlier this phase, the fourth (an evaluator tick,
or any other caller, hitting a tenant that exists but hasn't reached
the active+credentialed gate yet -- must be refused, not served) was
still an explicitly-skipped stub in
api/queryapi/tenant_isolation_gap_test.go.

Investigating it found the two storage engines needed genuinely
different treatment:

- ClickHouse (enterprise/internal/chrunner) already had this property
  structurally, for free: Registry is built once at startup from
  rbacstore.ListProvisionedDataSources, which already filters to
  active+credentialed tenants only, so a mid-provisioning tenant is
  simply absent from the connection map. New test
  TestRegistryRefusesMidProvisioningTenant proves this without Docker
  -- an empty DataSource list never dials ClickHouse, so this genuinely
  runs in this environment, unlike every other test in that file.

- Tantivy (search/src/registry.rs's IndexRegistry) was a real, different
  gap, not just an unverified assumption: it opens-or-creates an index
  for any syntactically-valid tenant_id on first request, because it's
  a separate process with no Postgres access and structurally can't
  know which tenants are actually provisioned. A query against a
  mid-provisioning tenant would have silently succeeded with zero
  results from a freshly-created empty index -- "ambient success"
  indistinguishable from "no matching logs," exactly the failure mode
  this item was worried about.

Fixed the Tantivy gap with a new enterprise/internal/searchclient.
TenantChecker interface (backed by a new rbacstore.TenantIsActive,
implemented structurally, no new import edge needed), consulted before
every gRPC call: Client.Search now refuses a non-active tenant before
it ever reaches `search`. Dial's signature gained a required
TenantChecker parameter; enterprise-api's main.go passes its existing
rbacstore.Store (already satisfies the interface). Verified Docker-free
via searchclient's existing real-in-process-gRPC-server test harness
(TestSearchRefusesMidProvisioningTenant, plus
TestSearchPropagatesTenantCheckerError for the fail-closed-on-error
case) -- both genuinely run in this environment, same bar as the rest
of the Tantivy isolation work.

rbacstore.TenantIsActive itself has two new skip-gated live-Postgres
tests (TestTenantIsActive, TestTenantIsActiveNonexistentTenant) --
disclosed as not run against a live database here, same gap as the
rest of this phase's Postgres-backed pieces.

api/queryapi/tenant_isolation_gap_test.go rewritten from a checklist
with one skipped stub to a full accounting of all four now-closed
probes. Docs updated in lockstep: CLAUDE.md, threat-model.md,
phase-4-isolation-design.md (implementation note added after its
original sign-off), phase-4-runbook.md (§9), enterprise/README.md.

enterprise/internal/rbacstore/rbacstore_test.go

@@ -607,3 +607,48 @@ func TestGetUserByEmailNotFound(t *testing.T) {
 		t.Fatalf("GetUserByEmail error = %v, want ErrNotFound", err)
 	}
 }
+
+// TestTenantIsActive is the rbacstore-side half of Phase 4 task 8's
+// item 4 adversarial probe -- enterprise/internal/searchclient's
+// TestSearchRefusesMidProvisioningTenant proves Search refuses when
+// TenantChecker.TenantIsActive returns false; this proves the real
+// implementation actually returns false for a mid-provisioning tenant
+// and only ever returns true once SetTenantStatus marks it active.
+func TestTenantIsActive(t *testing.T) {
+	s := testStore(t)
+	ctx := context.Background()
+	tenantID := "test-tenant-" + uniqueSuffix()
+
+	if _, err := s.CreateTenant(ctx, tenantID, "Test Tenant"); err != nil {
+		t.Fatalf("CreateTenant: %v", err)
+	}
+	active, err := s.TenantIsActive(ctx, tenantID)
+	if err != nil {
+		t.Fatalf("TenantIsActive (provisioning): %v", err)
+	}
+	if active {
+		t.Fatal("a freshly-created tenant (status 'provisioning') must not be active")
+	}
+
+	if err := s.SetTenantStatus(ctx, tenantID, "active"); err != nil {
+		t.Fatalf("SetTenantStatus: %v", err)
+	}
+	active, err = s.TenantIsActive(ctx, tenantID)
+	if err != nil {
+		t.Fatalf("TenantIsActive (active): %v", err)
+	}
+	if !active {
+		t.Fatal("expected the tenant to be active after SetTenantStatus")
+	}
+}
+
+func TestTenantIsActiveNonexistentTenant(t *testing.T) {
+	s := testStore(t)
+	active, err := s.TenantIsActive(context.Background(), "does-not-exist-"+uniqueSuffix())
+	if err != nil {
+		t.Fatalf("TenantIsActive: %v, want a plain (false, nil) for a nonexistent tenant, not an error", err)
+	}
+	if active {
+		t.Fatal("a nonexistent tenant must not be reported active")
+	}
+}