Exercise every wired v2 action against a live manager

Drive each wired v2 action through the entry point that really reaches it — REST v2, GraphQL, the CLI, or the bgtask that runs it — against a running manager, and record where the run disagrees with what the wiring declares.

### Why this is separate

The sweep in BA-7486 read the code only. It can say a wiring exists and that nothing constructs the action; it cannot say what happens when a request arrives. These are the questions only a run answers:

- Whether an action the catalog lists is reachable from any client at all, and by which route.
- Whether the gate the wiring declares is the gate the request actually meets — admin and non-admin both.
- Whether the audit row a run leaves carries the entity type, operation and action name the catalog predicts.
- Whether a lookup miss and a permission denial come back indistinguishable where the no-leakage rule requires it.
- Whether a partial bulk run answers one item per named entity, in order, with denials and misses told apart.

### How

Restart the local stack, sign in as an admin and as a non-admin, and exercise the actions through ./bai and the REST/GraphQL surface. Read the resulting logs, metrics and audit rows through the Grafana MCP rather than the console. Start from the operations the static sweep flagged as unreachable or wrongly declared, then widen.

### Deliverable

The findings are recorded as a comment on this issue and as the runtime document under docs/reports/. Each fix group is then filed as its own issue; this task covers the test run only, not the fixes.

JIRA Issue: BA-7489

Restart the local stack, then start with the operations flagged by the static sweep as unreachable or wrongly declared. Exercise them through ./bai, REST v2, GraphQL, or the relevant bgtask as both admin and non-admin, and inspect logs, metrics, and audit rows through the Grafana MCP. Done means recording runtime discrepancies in a comment and docs/reports/ document, with each fix group filed separately.

Written by the indexing model from the issue text.