test(BA-7809): add scenario tests for the user resource policy

[jopemachine]

📚 Stacked PRs

Part of the resource policy scenario stack under BA-7809. Merge in order (bottom-up):

1. test(BA-7809): let the user policy seed carry a concurrent-login cap #14534 — test(BA-7809): user policy seed carries a concurrent-login cap
2. test(BA-7809): add scenario tests for the project resource policy #14515 — test(BA-7809): project resource policy scenarios
3. test(BA-7809): add scenario tests for the keypair resource policy #14516 — test(BA-7809): keypair resource policy scenarios
4. 👉 test(BA-7809): add scenario tests for the user resource policy #14517 — test(BA-7809): user resource policy scenarios ← you are here

Resolves BA-7809

Summary

• Write the user policy chapter of api/adapters/resource_policy/KNOWLEDGE.md and transcribe it on top of test(BA-7809): add scenario tests for the keypair resource policy #14516: 27 rows, all 6 of its adapter calls reached, which completes the adapter — 83 rows over 6 modules, every one of its 17 calls exercised.
• The user policy owns no row of its own: it is an OwnFamily like the keypair policy, so registering UserPolicies runs every shared row and every own-policy row against it. Reading one's own user policy goes straight off the user's row, so it has no not-found row.
• The row that clears the concurrent-login cap seeds a policy holding one through test(BA-7809): let the user policy seed carry a concurrent-login cap #14534.

Test plan

• python3 scripts/knowledge/check.py passes
• test-scenario on CI: 83 scenarios, 0 failing
• report.md regenerated from the run's scenarios.jsonl with scripts/scenario-report.py --split; only the inherited batch_load_fields is left unexercised

🤖 Generated with Claude Code

https://claude.ai/code/session_019vFCmtPMD6GLPBJxJoFroD

[jopemachine]

Reopened as independent PRs against main, one issue each: #14547 (BA-7854 seed), #14548 (BA-7851 project), #14549 (BA-7852 keypair), #14550 (BA-7853 user).