fix(evidence): reconcile generations safely

harness/scripts/create_vector_writer_rpc.sql

@@ -40,6 +40,25 @@ begin
 end;
 $$;
 
+create or replace function public.list_evidence_generations(table_name text, kind text)
+returns table(generation text)
+language plpgsql
+security definer
+set search_path = public, vectors, extensions
+as $$
+begin
+  if table_name <> 'evidence' or kind <> 'evidence' then
+    raise exception 'only exact Evidence generations may be listed';
+  end if;
+  return query
+    select distinct e.metadata->>'vector_generation'
+      from vectors.evidence e
+     where e.kind = 'evidence'
+       and e.metadata->>'vector_generation' ~ '^gen:[0-9a-f]{32}$'
+     order by 1;
+end;
+$$;
+
 create or replace function public.existing_vector_hashes(table_name text, kinds text[])
 returns table(record_key text, content_hash text)
 language plpgsql
@@ -125,6 +144,7 @@ revoke all on function public._assert_vector_write_table(text, text[]) from publ
 revoke all on function public.existing_vector_hashes(text, text[]) from public;
 revoke all on function public.upsert_vector_records(text, jsonb) from public;
 revoke all on function public.delete_vector_generation(text, text, text) from public;
+revoke all on function public.list_evidence_generations(text, text) from public;
 
 -- Su alcuni progetti Supabase le funzioni in `public` ricevono grant automatici: revoca
 -- esplicitamente dai ruoli client generici, poi abilita solo il writer dedicato.
@@ -134,16 +154,19 @@ begin
     revoke all on function public.existing_vector_hashes(text, text[]) from anon;
     revoke all on function public.upsert_vector_records(text, jsonb) from anon;
     revoke all on function public.delete_vector_generation(text, text, text) from anon;
+    revoke all on function public.list_evidence_generations(text, text) from anon;
   end if;
   if exists (select 1 from pg_roles where rolname = 'authenticated') then
     revoke all on function public.existing_vector_hashes(text, text[]) from authenticated;
     revoke all on function public.upsert_vector_records(text, jsonb) from authenticated;
     revoke all on function public.delete_vector_generation(text, text, text) from authenticated;
+    revoke all on function public.list_evidence_generations(text, text) from authenticated;
   end if;
   if exists (select 1 from pg_roles where rolname = 'vector_writer') then
     grant execute on function public.existing_vector_hashes(text, text[]) to vector_writer;
     grant execute on function public.upsert_vector_records(text, jsonb) to vector_writer;
     grant execute on function public.delete_vector_generation(text, text, text) to vector_writer;
+    grant execute on function public.list_evidence_generations(text, text) to vector_writer;
   end if;
 end $$;