fix(access-control): show objects shared with everyone in the project in lists

[a-lider]

Problem

A user with resource-level "No access" loses objects from lists that they can still open by URL. Example: dashboards are "No access" for the user, one dashboard is shared as "Everyone in the project: editor". The dashboard opens from a direct link, but the dashboards list does not show it.

The list allowlist only counted member and role grants. A default ("everyone in the project") grant on the object never counted, so the list and the detail endpoint disagreed.

Changes

• Lists, search, and HogQL-visible schema now include objects whose own default rule grants access, for users with no resource-level access. Objects shared with a member or role behaved this way already; the everyone-share now matches.
• A personal or role "No access" row on the same object still hides it: explicit rows decide before the default row.
• Code: _blocked_and_allowed_object_ids now adds an object to the allowed set when its default rows grant a level above "none". Two lines plus docstrings.
• allowlisted_resource_ids_by_scope inherits the change, so the HogQL guard, the schema gate, and ee/api/subscription.py widen the same way. The change is additive only: nothing newly readable, since the detail endpoint already served these objects.

Independent of the refactor in #89361; whichever lands second rebases a small conflict in the same method.

How did you test this code?

• New test test_filter_queryset_allowlists_objects_granted_to_everyone: catches the regression where an everyone-share disappears from lists under resource-level "none", and asserts a member "none" row still overrides the grant. No existing test covered the default-grant shape.
• Updated the property-based oracle (oracle_blocked_and_allowed_object_ids) to the new rule; the PBT suite holds the implementation, the HogQL guard derivation, and REST filtering to that oracle across arbitrary row configurations.
• Not run locally (worktree checkout) — relying on CI for the suite results.

Automatic notifications

• Publish to changelog?

Docs update

None — posthog/hogql/ACCESS_CONTROL.md does not state the old allowlist rule.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

• Written with Claude Code. Skills invoked: /writing-tests, /writing-pr-descriptions.
• Behavior change made deliberately after reviewing the gap: the fix moves lists to agree with the detail endpoint, and matches the rule the upcoming most-specific resolution enforces everywhere.

[github-actions]

🤖 CI report

⚠️ Trunk lane — backend Python lane

This PR is assigned to the backend Python lane. It runs backend Python tests and may merge in parallel with PRs in other lanes.

[trunk-io]

Merging to master in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here