Function upgrade_data_lake_schema_v7 

pub async fn upgrade_data_lake_schema_v7(
    tr: &mut Transaction<'_, Postgres>,
) -> Result<(), Error>

Upgrades the data lake schema to version 7. Adds audience_grants: the DB-backed audience grant store, a 1:1 stand-in for the long-term model’s group_read_grants/group_mint_grants tables. One table with an axis column ('read'/'mint') rather than two, mirroring today’s single env-var grant map ({prefix}_AUDIENCE_GRANTS); (audience, axis, selector) is the row’s own natural key, so there is no surrogate grant_id the way ingestion_api_keys.key_id has one (a grant carries no secret to keep unlinkable from its own identity). No revoked_at/revoked_by either – grants are hard-DELETEd, since a removed grant has no ongoing artifact whose provenance a caller might later need. The two CHECK constraints mirror the same validation AudienceGrants::from_rows (rust/auth/src/policy.rs) re-runs independently in Rust, so a row inserted by any means other than the admin API (a manual psql fix, a future migration) still can’t produce an unparseable or unreadable grant silently.