Phase 4 verification pass: re-run every Docker-free check, fix drift

Docker access is still unavailable in this environment (permission
denied on the socket, no docker group membership, no passwordless
sudo -- confirmed again), so this can't be the live-infrastructure
verification pass Phase 4 actually needs. What it can be: re-running
every command this runbook claims is Docker-free and fixing what's
drifted since it was written across several commits.

Found and fixed by actually executing each command, not just reading
the prose:

- go test ./internal/chwriter/... -run TestRegistry -v (§14) doesn't
  match what the surrounding paragraph claims it verifies --
  TestRegistry as a regex matches TestRegistryWritesEachTenantToItsOwnDatabase/
  TestRegistryRefusesUnprovisionedTenant (the live-ClickHouse tests,
  which just skip), not TestWriteBatchRefusesEmptyTenantID/
  TestWriteBatchRefusesUnknownTenantWithEmptyRegistry (the actual
  Docker-free fail-closed tests the paragraph describes). Fixed the
  filter and left a note explaining the mismatch, since it's the kind
  of thing worth knowing was caught by running the command, not just
  proofreading it.
- §9's cargo test still said "expect 14 tests passing" -- stale since
  the Tantivy write-routing and active-tenant-gate passes added 10 more
  (now 24, verified by actually running it). Added a pointer to the new
  registry.rs/tenants.rs tests those two passes added.
- §3a's "Not yet built: an equivalent for revoking/listing memberships"
  was stale -- -revoke-membership-*/-list-memberships-tenant/
  -transfer-owner-* all exist now. Narrowed the still-accurate part
  (dashboard_permissions grants have no operator flag) and pointed at
  sentryctl dashboards permissions instead, which does cover it.
- The "Two genuine exceptions" intro undercounted its own list, which
  had grown to five items across later edits without the header being
  updated to match.

Every other Docker-free command in this runbook (§3a/§3b's login
tests, §9's searchclient/chrunner mid-provisioning probes, §11's
tenantcrd tests, §12's session/loginhandler tests, §13's ingest
identity tests, §14's active-tenant-gate tests, the cli dashboard-
permissions tests, docker compose config's profile/port/alias
assertions) was re-run and matches what the doc already claimed -- no
further drift found. Full cross-module build/vet/test sweep (all Go
modules including terraform/, search's cargo build/clippy,
hack/check-tenant-boundary.sh) also re-confirmed clean.

docs/phase-4-runbook.md

@@ -11,7 +11,7 @@ stack**, not asserted. This one is different, and says so plainly rather
 than papering over it: for the great majority of this phase's work,
 **there was no working Docker daemon access and no reachable Kubernetes
 cluster**, so most of what follows is a *procedure to run*, not a report
-of what was already run and passed. Two genuine exceptions:
+of what was already run and passed. Five genuine exceptions so far:
 
 - `enterprise/internal/audit`'s hash-chain, tamper-detection, and
   concurrent-write guarantees (task 4) -- verified live against a real
@@ -175,10 +175,14 @@ browser, complete the IdP's login, and confirm you land on
 -provision-tenant`'s ClickHouse/Tantivy data-plane provisioning (§8),
 so a tenant created this way can log users in immediately but can't yet
 serve their queries until that's run too, the same "two separate
-operator actions" gap named in "Known gaps" below. Not yet built: an
+operator actions" gap named in "Known gaps" below.
-equivalent for revoking/listing memberships, or anything for
+`-revoke-membership-*`/`-list-memberships-tenant`/`-transfer-owner-*`
-`dashboard_permissions` grants (§5a) beyond calling the HTTP endpoints
+cover revoking, listing, and reassigning ownership the same way
-directly.
+`-grant-membership-*` covers granting (all offline operator flags, same
+shape as `-create-tenant`) -- `dashboard_permissions` grants (§5a) are
+the one thing here still only reachable via the HTTP endpoints
+directly, no operator flag, since `sentryctl dashboards permissions
+list|grant|revoke` already exists as that surface instead (§5a).
 
 ## 3b. `enterprise-auth`: human login via SAML (new -- same "verified
 live in this session, not against a real running container or a real
@@ -408,9 +412,14 @@ cd search
 cargo build
 cargo clippy --all-targets -- -D warnings
 cargo test
-# expect 14 tests passing, including
+# expect 24 tests passing, including
 # registry::tests::tenant_index_is_isolated_from_default_and_other_tenants
-# -- item 3 of /docs/phase-4-isolation-design.md's verification plan.
+# -- item 3 of /docs/phase-4-isolation-design.md's verification plan --
+# and, since §14's write-routing pass, registry::tests::
+# commit_all_commits_default_and_every_opened_tenant_index and the
+# tenants:: module's real-TCP-server tests for ActiveTenantTracker
+# (start_fetches_and_serves_the_initial_list,
+# start_fails_closed_when_the_first_fetch_fails, etc. -- see §14).
 
 cd ../enterprise
 go test ./internal/searchclient/... -v
@@ -694,12 +703,17 @@ without Docker, using the same fake-transport discipline as §13:
 
 ```sh
 cd enterprise
-go test ./internal/chwriter/... -run TestRegistry -v
+go test ./internal/chwriter/... -run 'TestWriteBatchRefuses' -v
 # Docker-free: constructs a Registry directly (bypassing New(), the only
 # part that dials ClickHouse) to prove the fail-closed paths -- an empty
 # TenantID, or a TenantID with no registered writer, refuses the WHOLE
 # batch rather than silently dropping just those records or falling back
-# to a default destination.
+# to a default destination. (Note: -run TestRegistry, an earlier version
+# of this command, actually matches TestRegistryWritesEachTenantToItsOwnDatabase/
+# TestRegistryRefusesUnprovisionedTenant instead -- the live-ClickHouse
+# tests below, which just skip -- not the Docker-free ones this
+# paragraph is about; caught by actually running this command while
+# revisiting the runbook.)
 
 go test ./internal/tenantprovision/... -run TestProvisionedUserCanInsertIntoOwnDatabase -v
 # skip-gated (needs a live ClickHouse) -- regression test for the bug