fix(rectification): allow runtime flag reads

frontend/supabase/migrations/20260811030000_feature_flags_admin_runtime_read_policy.sql

@@ -0,0 +1,15 @@
+begin;
+
+do $$
+begin
+  if exists (select 1 from pg_roles where rolname = 'admin_runtime') then
+    grant select on table public.feature_flags to admin_runtime;
+
+    drop policy if exists feature_flags_admin_read on public.feature_flags;
+    create policy feature_flags_admin_read on public.feature_flags
+      for select to admin_runtime using (true);
+  end if;
+end;
+$$;
+
+commit;

frontend/tests/rectification-v9-database.test.ts

@@ -798,6 +798,7 @@ test("v9 agent api migration applies, seeds the runtime flag and guards consent"
     });
     assert.equal(migration.status, 0, migration.stderr);
     assert.match(migration.stdout, /applied 20260813010000_agentic_rectification_v9_agent_api\.sql/);
+    assert.match(migration.stdout, /applied 20260811030000_feature_flags_admin_runtime_read_policy\.sql/);
 
     // The runtime selector flag is published and enabled.
     assert.equal(
@@ -805,6 +806,16 @@ test("v9 agent api migration applies, seeds the runtime flag and guards consent"
         from public.feature_flags where flag_key = 'rectification_runtime_version'`),
       "true:100:published",
     );
+    assert.equal(
+      fixture.psqlAs(
+        "admin_runtime",
+        "admin-runtime-test-password",
+        `select enabled || ':' || rollout_percentage || ':' || status
+          from public.feature_flags
+          where flag_key = 'rectification_runtime_version'`,
+      ),
+      "true:100:published",
+    );
 
     // Run phases table exists with RLS.
     assert.equal(