fix(safegres): L4 counts views, so a view-only read path is not dead schema USAGE

[pyramation]

Summary

Reconciles the L4/L8 interaction surfaced by #1606: on corpus case 25-definer-view-bypass, L8 reported that corpus_anon reads a table through a view in a schema while L4 reported, on the same run, that the role's USAGE on that schema is dead and revokable. checkDeadSchemaUsage counted only TableSnapshots, so a role whose only reachable object in a schema is a view looked like it reached nothing — a recommend-a-revoke on a grant the API is actively serving through, which is exactly what the lattice is not allowed to do.

 export function checkDeadSchemaUsage(
   schemaAcls: SchemaAclInfo[],
   tables: TableSnapshot[],
-  graph: RoleGraph
+  graph: RoleGraph,
+  views: Array<{ schema: string; grants: GrantInfo[] }> = []
 ): Finding[]

-  const reachesRelation = schemaTables.some((t) => effectiveGrants(t, g.role, graph).length > 0);
+  const reachesRelation = [...schemaTables, ...(viewsBySchema.get(acl.schema) ?? [])]
+    .some((r) => effectiveGrants(r, g.role, graph).length > 0);

The parameter is optional so existing callers keep compiling, but the audit always passes it: needsViews now includes L4, so the single introspectViews call added by #1606 (already shared by the perf paths and L8) also feeds L4. The view ACL composes through the same PUBLIC/inheritance closure as a table's — effectiveGrants was widened to Pick<TableSnapshot, 'grants'> in #1606, so no new closure logic.

Pinned negatively where it was found: corpus case 25 now carries "L4" in forbid, so the false positive cannot come back silently. Unit test covers both directions (a view in the schema clears L4; a view in another schema does not).

pnpm build, pnpm lint, pnpm test (336) pass in packages/safegres.

Link to Devin session: https://app.devin.ai/sessions/f340c08768814b278a179aea7994f924
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring