Support ancestor authorization on interfaces

[zth]

What changed

• allow @gql.authorize.byAncestor on interface types and fields
• inherit interface assertions onto each concrete field coordinate, including through interfaces implementing interfaces
• preserve concrete direct dispositions and concrete type defaults as overrides
• prefer field-level interface assertions over interface type defaults
• document the inheritance and override rules

Safety

The existing path-dominance proof still runs independently for every concrete field. An inherited assertion fails generation if any concrete field is reachable through an unprotected path. The annotation remains compile-time-only and emits no additional runtime policy evaluation.

Tests cover interface type and field defaults, exact manifest provenance, concrete public overrides, transitive interface inheritance, and unsafe-path rejection.

Validation

• opam exec --switch=5.3.0 -- make test
• opam exec --switch=5.3.0 -- make checkformat
• git diff --check

[zth]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 4b7fd06062

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".