perf(grc): normalize runtime scope reads

[jonathanhaaswriter]

Summary

• Materialize bounded tenant, source, and application-workspace scope columns from source_runtimes.runtime_json, index those columns concurrently, and retire the replaced JSON-expression indexes.
• Resolve GRC dashboard runtime scope inside Postgres so the aggregate query no longer expands every runtime ID into Go allocations and SQL placeholders.
• Keep tenant and workspace predicates together in the runtime scope, reuse normalized tenant scope for compliance snapshots, and preserve the existing compatibility path for requests without one tenant authority.
• Continue reading materialized finding_evidence_counts; the aggregate plan does not scan raw finding_evidence.

Measured result

Exact-head 397003c0293b718768c46e0fe3b205ddabdcd824 synthetic 500-runtime query-construction benchmark, three 2-second runs on darwin/arm64:

path	median ns/op	B/op	allocs/op
runtime ID expansion	85,344	193,222	1,318
normalized runtime scope	1,089	3,288	31

That is 98.7% less query-construction time, 98.3% fewer allocated bytes, and 97.6% fewer allocations.

Postgres 16 scope-plan comparison over synthetic runtime/finding rows, 12 alternating warm runs:

path	query bytes	median planning	median execution	shared hits
250 expanded runtime IDs	3,844	1.556 ms	5.010 ms	504
tenant + workspace scope	204	1.700 ms	5.610 ms	546

The normalized plan cuts query text 94.7% and makes scope cardinality independent of runtime count. The measured database tradeoff is +0.600 ms execution and 42 shared-buffer hits on this synthetic corpus.

Validation

• CEREBRO_POSTGRES_DSN=... go test ./internal/statestore/postgres -run TestGRCDashboardAggregatePlanUsesMaterializedEvidenceCountsPostgresIntegration -count=1
• CEREBRO_POSTGRES_DSN=... go test ./internal/statestore/postgres -run TestSourceRuntimeGeneratedScopeColumnsStayTenantWorkspaceIsolatedPostgresIntegration -count=1
• go test ./... -count=1
• go test -race ./internal/statestore/postgres ./internal/bootstrap -count=1
• make lint-internal
• make check-structural check-structural-test check-arch
• make changed-check