Refuse a data copy the target can't hold before restoring (S-007-6..11) #125

Builds part of spec S-007, docs/specs/007-data-copy-schemas.md (feature issue #82): the acceptance criteria below. Each needs a test that names its id (test_s007_<k>_..., or a proves: S-007-6 comment line).

This is the data copy preflight (missing schemas, extensions, roles, auth. references) and a restore that leaves no partial target. The flag is --source-schema (MCP source_schema), on the maintainer's answer on #134.

• S-007-6: --source-schema missing for a schema the source lacks exits PRECONDITION with code data_copy_preflight_refused and missingSchemas of ["missing"], and no dump file is written
• S-007-7: A selected table using a type from an extension that is not in the target's pg_available_extensions exits PRECONDITION with code data_copy_preflight_refused naming that extension under extensions, the target holds no new table, and no receipt is written
• S-007-8: A policy TO anon, authenticated on a selected table, with neither role on the target, exits PRECONDITION with code data_copy_preflight_refused and roles of ["anon", "authenticated"]
• S-007-9: With --source-schema public, a function public.current_tenant() whose body calls auth.uid() and a policy on public.notes whose USING calls auth.uid() are both named under authReferences, and the copy is refused
• S-007-10: A source with a missing extension, a missing role, and an auth. reference at once is refused with all three named in one answer
• S-007-11: A restore that fails after the preflight passes exits ENGINE_STEP_FAILED, leaves no table in the selected schemas of the target, writes no receipt, and a second run against the same target passes the empty-target check

Depends on #124