fix(ks+teaching): realtime schema, ledger permissions, and cohort-visible teaching content

K&S (from the full system test):
Realtime subscriptions still targeted schema 'public' after the merge, so no
live update ever fired. Replica identity was PK-only, so DELETE events were
dropped by the matter_id filter. The adjustment logger ran as a BEFORE trigger
and deadlocked against its own recompute. The ledger view joined a table
students cannot read. MattersList/Dashboard gated on a synthetic 'admin'
persona the merge had deleted, so instructors saw one persona's matters and
Admin Controls was permanently hidden.

Teaching content visibility:
Everything seeded under the instructor account was unreachable by students,
silently. workflow_shares had zero rows, so no student had ever been able to
see or run any teaching workflow. Playbooks, clauses and the knowledge base
are owner-scoped with no share mechanism at all.

listTeachingOwnerIds() grants READ over the unfiled content of the creators of
the groups a user belongs to - group-derived rather than hardcoded, empty for
everyone else. Write paths are untouched, so students duplicate rather than
edit; responses carry read_only and the UI says so. match_kb_chunks and
match_clauses take a new teaching_owners[] argument (additive overload).

searchClauses now always runs the keyword pass: match_clauses requires a
non-null embedding, and SQL-seeded clauses have none, so every seeded teaching
clause was invisible to search_clauses.

Week 9 teaching build: ten workflows, a 12-rule change-management playbook,
five templates, four reference notes and seven persona documents.