Creating a scope now goes through one ops call that writes the row with its
parent association, its virtual scope, its SYSTEM roles, and the roles its
scope type's presets call for — so project creation is a single transaction
again instead of splitting the virtual-scope write off on its own.

- ScopeCreation becomes an ABC: an implementation names the row to insert and
  derives the scope from it, so the id stays database-generated.
- Role provisioning is bulk: one insert for every role and one for every
  permission, whatever the number of scopes.
- Scopes are addressed by ScopeRef throughout; the role/permission enums are
  reached only where the rows are written.
- GroupCreatorSpec declares its integrity_error_checks, replacing the three
  pre-check SELECTs in GroupDBSource.create with the constraints themselves,
  which also closes the check-then-insert race.

The system-role test now asserts the roles and permissions the database ends
up with rather than the calls made to RoleManager.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…h RBAC ops

Project purge and user add/remove now go through the RBAC ops provider so
every membership change is recorded on the virtual-scope chain and scope
deletion owns its whole contract.

- remove_entity_members takes an EntityMembersRemoval mirroring the
  addition: members whose assign_role_on names a user also get every role
  at the scope revoked.
- delete_scope/batch_delete_scopes accept RBAC entity purgers, so a scope
  delete cleans its permissions and scope associations along with the row
  and its virtual scope node.
- GroupDBSource modify/assign/unassign/bind/unbind use add_entity_members
  and remove_entity_members via write_ops; purge_group deletes the group
  through delete_scope with the new ProjectPurgerSpec.
- The db_source addresses projects and users by ProjectID/UserID, with the
  repository converting at its boundary.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…nel purge guard

- remove_entity_members takes a scope and entity refs directly; membership
  removal no longer revokes the user's roles at the scope
- replace the hand-written active-kernel pre-check in purge_group with a
  declarative conflict check on GroupKernelBatchPurgerSpec
- drop the _project_scope/_user_entity_ref wrappers and construct
  ScopeRef/EntityRef at the call sites, typed with ProjectID/UserID
- provision the virtual scope in the assign/unassign test fixtures now that
  membership writes resolve it

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>