Close the last tenant-isolation adversarial probe (mid-provisioning tenants)

Phase 4 task 8's verification plan named four adversarial probes;
three were closed earlier this phase, the fourth (an evaluator tick,
or any other caller, hitting a tenant that exists but hasn't reached
the active+credentialed gate yet -- must be refused, not served) was
still an explicitly-skipped stub in
api/queryapi/tenant_isolation_gap_test.go.

Investigating it found the two storage engines needed genuinely
different treatment:

- ClickHouse (enterprise/internal/chrunner) already had this property
  structurally, for free: Registry is built once at startup from
  rbacstore.ListProvisionedDataSources, which already filters to
  active+credentialed tenants only, so a mid-provisioning tenant is
  simply absent from the connection map. New test
  TestRegistryRefusesMidProvisioningTenant proves this without Docker
  -- an empty DataSource list never dials ClickHouse, so this genuinely
  runs in this environment, unlike every other test in that file.

- Tantivy (search/src/registry.rs's IndexRegistry) was a real, different
  gap, not just an unverified assumption: it opens-or-creates an index
  for any syntactically-valid tenant_id on first request, because it's
  a separate process with no Postgres access and structurally can't
  know which tenants are actually provisioned. A query against a
  mid-provisioning tenant would have silently succeeded with zero
  results from a freshly-created empty index -- "ambient success"
  indistinguishable from "no matching logs," exactly the failure mode
  this item was worried about.

Fixed the Tantivy gap with a new enterprise/internal/searchclient.
TenantChecker interface (backed by a new rbacstore.TenantIsActive,
implemented structurally, no new import edge needed), consulted before
every gRPC call: Client.Search now refuses a non-active tenant before
it ever reaches `search`. Dial's signature gained a required
TenantChecker parameter; enterprise-api's main.go passes its existing
rbacstore.Store (already satisfies the interface). Verified Docker-free
via searchclient's existing real-in-process-gRPC-server test harness
(TestSearchRefusesMidProvisioningTenant, plus
TestSearchPropagatesTenantCheckerError for the fail-closed-on-error
case) -- both genuinely run in this environment, same bar as the rest
of the Tantivy isolation work.

rbacstore.TenantIsActive itself has two new skip-gated live-Postgres
tests (TestTenantIsActive, TestTenantIsActiveNonexistentTenant) --
disclosed as not run against a live database here, same gap as the
rest of this phase's Postgres-backed pieces.

api/queryapi/tenant_isolation_gap_test.go rewritten from a checklist
with one skipped stub to a full accounting of all four now-closed
probes. Docs updated in lockstep: CLAUDE.md, threat-model.md,
phase-4-isolation-design.md (implementation note added after its
original sign-off), phase-4-runbook.md (§9), enterprise/README.md.

enterprise/internal/searchclient/searchclient.go

@@ -13,6 +13,25 @@
 // the authenticated request identity before every call -- exactly the
 // same "read from ctx, never a parameter, fail closed if absent" shape
 // chrunner.Registry.RunSQL uses for ClickHouse.
+//
+// One real divergence from chrunner, found while closing
+// /docs/phase-4-isolation-design.md's verification-plan item 4 (a
+// mid-provisioning tenant must be refused, not served): search/src/
+// registry.rs's IndexRegistry opens-or-creates an index for *any*
+// syntactically-valid tenant_id on first request -- it has no concept of
+// "is this tenant actually provisioned," because it's a separate
+// process with no Postgres access, so it structurally can't know.
+// chrunner gets its fail-closed property for free (a tenant not yet
+// active+credentialed is simply absent from the immutable map
+// enterprise-api's main.go builds at startup from
+// rbacstore.ListProvisionedDataSources) -- Tantivy has no equivalent
+// startup-time gate, so without a check *here*, a query against a
+// mid-provisioning (or entirely made-up) tenant would silently succeed
+// with zero results from a freshly-created empty index, rather than
+// refusing -- "ambient success" masquerading as "no matching logs,"
+// exactly the failure mode the verification plan named. TenantChecker
+// closes that: Search now refuses before the gRPC call ever goes out if
+// the tenant isn't active in rbacstore.
 package searchclient
 
 import (
@@ -26,20 +45,38 @@ import (
 	searchv1 "github.com/sentry/sentry/proto/sentry/search/v1"
 )
 
+// TenantChecker answers "is this tenant allowed to search at all" --
+// backed by rbacstore.Store.TenantIsActive in production (a narrow
+// interface, not *rbacstore.Store directly, so this package doesn't
+// need rbacstore's full surface and tests can fake it without a live
+// Postgres). Never cached: SetTenantStatus's doc comment already
+// established "every tenant-resolution path elsewhere must re-check
+// this via GetTenant, never cache/assume 'active'" for chrunner-style
+// resolution, and the same reasoning applies here.
+type TenantChecker interface {
+	TenantIsActive(ctx context.Context, tenantID string) (bool, error)
+}
+
 type Client struct {
-	grpc searchv1.SearchServiceClient
-	conn *grpc.ClientConn
+	grpc    searchv1.SearchServiceClient
+	conn    *grpc.ClientConn
+	tenants TenantChecker
 }
 
 // Dial mirrors api/searchclient.Dial exactly (same plain-TCP, no-TLS
-// internal-service-to-service trust boundary) -- the only difference
-// from that package is what Search does with the resolved tenant.
-func Dial(addr string) (*Client, error) {
+// internal-service-to-service trust boundary) aside from the added
+// TenantChecker -- the only difference from that package is what Search
+// does with the resolved tenant. tenants is required, not optional:
+// every production caller of this package is enterprise-api, which
+// always has a live rbacstore.Store to pass (unlike, say,
+// authz.Authorizer, there is no legitimate deployment shape where this
+// package runs without one).
+func Dial(addr string, tenants TenantChecker) (*Client, error) {
 	conn, err := grpc.NewClient(addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
 	if err != nil {
 		return nil, fmt.Errorf("dialing search service at %s: %w", addr, err)
 	}
-	return &Client{grpc: searchv1.NewSearchServiceClient(conn), conn: conn}, nil
+	return &Client{grpc: searchv1.NewSearchServiceClient(conn), conn: conn, tenants: tenants}, nil
 }
 
 func (c *Client) Close() error {
@@ -48,11 +85,14 @@ func (c *Client) Close() error {
 
 // Search implements executor.SearchClient. Resolves the caller's tenant
 // from ctx (never a parameter) and fails closed -- no authenticated
-// identity, or an identity with no tenant (RoleService, or a
-// misconfigured authorizer), refuses the call rather than falling back
-// to the single default index, which would silently defeat the whole
-// point of this package existing. This mirrors chrunner.Registry.RunSQL's
-// exact fail-closed shape.
+// identity, an identity with no tenant (RoleService, or a misconfigured
+// authorizer), or a tenant that isn't active in rbacstore all refuse the
+// call rather than reaching `search`, which would otherwise silently
+// open-or-create a fresh empty index for a tenant that was never
+// actually provisioned (see this file's package doc comment). This
+// mirrors chrunner.Registry.RunSQL's exact fail-closed shape, just with
+// an explicit check where chrunner gets the same guarantee for free from
+// its immutable connection map.
 func (c *Client) Search(ctx context.Context, query string, limit uint32) ([]string, error) {
 	identity, ok := authz.IdentityFromContext(ctx)
 	if !ok {
@@ -61,6 +101,13 @@ func (c *Client) Search(ctx context.Context, query string, limit uint32) ([]stri
 	if identity.TenantID == "" {
 		return nil, fmt.Errorf("searchclient: authenticated identity %q has no tenant, refusing to search", identity.Role)
 	}
+	active, err := c.tenants.TenantIsActive(ctx, identity.TenantID)
+	if err != nil {
+		return nil, fmt.Errorf("searchclient: checking tenant %q status: %w", identity.TenantID, err)
+	}
+	if !active {
+		return nil, fmt.Errorf("searchclient: tenant %q is not active, refusing to search", identity.TenantID)
+	}
 
 	resp, err := c.grpc.Search(ctx, &searchv1.SearchRequest{Query: query, Limit: limit, TenantId: identity.TenantID})
 	if err != nil {