Correct the attach lock-order comment. The order matches admin move, and what
makes it mandatory is invitation acceptance: it holds `workspace-invitations:<id>`
while waiting for the workspace row, so row-locking first (as this did)
deadlocks against it. The previous ownership-transfer justification did not
hold — that path takes the organization lock before its workspace rows too, so
the two agree on order rather than inverting.

Drop `cancelInvitation`. The `revokeInvitationAsAdmin` extraction left it with
no callers, and an unlocked, unauthorized `status = 'cancelled'` flip sitting
next to the fenced replacement is easy to reach for by mistake.

Drop the unused `executor` parameters from `hasWorkspaceAdminAccess` and
`isOrganizationAdminOrOwner`. No caller threads a transaction through either,
and the former goes back to delegating to `checkWorkspaceAccess` instead of
re-deriving the same permission itself.

Import `chunkArray` from `@sim/utils/helpers` everywhere and remove the
re-export from `batch-delete.ts`, so the symbol has one source rather than a
non-barrel shim plus the package.

Restore the bounded attachability check in `addDashboardOrganizationMember`:
scope the query to the selected ids instead of listing every attachable
workspace and scanning that array per selection.

Resolve the credential-creation permission through
`getEffectiveWorkspacePermission` rather than a second copy of the org-admin
derivation ladder, so the rule cannot drift from the shared resolver.

Co-Authored-By: Claude <noreply@anthropic.com>

`revokeInvitationWorkspaceGrant` lost its only caller when the DELETE route
moved to `revokeInvitationAsAdmin`, leaving a locked wrapper nothing invoked.
Remove it and fold its documentation into `revokeInvitationWorkspaceGrantTx`,
which direct grants and scoped revocation still call. The grant-revocation test
now drives the transactional form directly, so the sibling-grant and
final-grant-cancels behaviour it covers stays under test.

`isSameOrgMember` has had no caller since before this branch — direct grant
resolves membership through `getUserOrganization` inside its own transaction —
so it and its tests go too.

`getWorkspaceMembership` is no longer imported outside its module now that
credential creation reads `getCredentialCreationWorkspaceContext`; make it
module-private rather than leave it on the public surface.

Co-Authored-By: Claude <noreply@anthropic.com>

Each was checked by hand across every file type, including barrel re-exports
and string references, rather than taken from a static analyzer.

`isUserMemberOfOrganization` has no reference anywhere.

`reapplyPaidOrgJoinBillingForExistingMember` only ever ran from two
lock-ordering tests. The transaction-enlisted form it delegated to is what the
subscription webhooks call and what those tests actually assert on, so they now
drive it directly. The assertions are unchanged: the wrapper contributed a
transaction, an organization lock and a membership existence check, none of
which appear in the recorded operations.

`replaceLargeValueReferences` and `replaceLargeValueReferencesWithClient` are
both thin wrappers over `replaceLargeValueReferenceKeysWithClient`, which
execution logging, human-in-the-loop resume and the trace backfill all still
call. The single test covering a wrapper now composes the key collection itself
and targets that live helper.

Co-Authored-By: Claude <noreply@anthropic.com>