test(BA-7802): add scenario tests for the client IP masking adapter

[jopemachine]

📚 Stacked PRs

Part of the system concern scenario stack (BA-7802). Merge in order (bottom-up):

1. test(BA-7802): add the shared components the system concern scenarios use #14510 — test(BA-7802): shared components the system concern scenarios use
2. test(BA-7802): add scenario tests for the runtime variant adapter #14521 — test(BA-7802): runtime variant
3. test(BA-7802): add scenario tests for the runtime variant preset adapter #14522 — test(BA-7802): runtime variant preset
4. test(BA-7802): add scenario tests for the resource slot type calls #14523 — test(BA-7802): resource slot type
5. test(BA-7802): add scenario tests for the retention policy adapter #14524 — test(BA-7802): retention policy
6. test(BA-7802): add scenario tests for the login client type adapter #14525 — test(BA-7802): login client type
7. 👉 test(BA-7802): add scenario tests for the client IP masking adapter #14526 — test(BA-7802): client IP masking ← you are here
8. test(BA-7802): add scenario tests for the secret adapter #14527 — test(BA-7802): secret

Fork at #14510: #14521 → #14522 is ordered; #14523–#14527 each sit on #14510 alone and may merge in any order after it.

Part of BA-7802

Summary

• Fill api/adapters/client_ip_masking/KNOWLEDGE.md and transcribe it into tests/scenario/bai_scenario/manager/client_ip_masking/ — 23 rows over three modules (upserting, searching, retiring) — with seeds/client_ip_masking/policy.py and components/client_ip_masking.py.
• A masking policy has no creator, only an upserter, so Seeder learns to write a GlobalEntityUpserter through upsert_global_entity.

What the rows pin:

• Upsert replaces the row whole: putting a policy on a target that has one rewrites the same id, and omitting the prefixes clears the stored ones.
• Each of the three targets and three modes gets a row.
• Upsert and search are behind the superadmin role (the monitor passes the search); purge is behind the entity gate, so rbac.enforcement_enabled=false opens purge and not upsert.

Test plan

• python3 scripts/knowledge/check.py passes
• The rows passed in CI run 34558080395 of the unsplit branch (181 rows over the seven adapters, 0 failing); report.md is generated from that run's artifacts with scripts/scenario-report.py --split
• test-scenario and verify-scenario-report pass on this PR

🤖 Generated with Claude Code

https://claude.ai/code/session_01Snp9H2jEVbB2s1C6ixUHGn

[jopemachine]

Superseded: the stack was dissolved into independent PRs, one issue each — #14535 (BA-7843 runtime variant), #14536 (BA-7844 preset), #14538 (BA-7845 resource slot type), #14542 (BA-7846 retention policy), #14543 (BA-7847 login client type), #14544 (BA-7848 client IP masking), #14545 (BA-7849 secret), #14546 (BA-7850 service catalog).