Merge main (upstream v0.16.24) into feature/compliance-roles

The schema conflicted as a binary file: taken from main and the one
edit here re-applied (sysComplianceGet after sysLegalHoldExport). The
import kept the permission count at 673, so the new id stays 673.

Retested on the merged tree in its own target directory: the
compliance and system suites pass. One earlier system run failed in
purge.rs (an imported blob not found) and didn't recur.

resources/schema/schema.json.sha256

@@ -1 +1 @@
-nh0Vx79fhlQAOjCC9it831hBytCjhGPloPm9qidUhGc
+8Wyl9buv_eSbbGGhV-UZcjGHG_H77eorpuoI2u6wgnY