Keep role re-assertion within a non-superuser provisioner's rights, and test the second boot

AGENTS.md

@@ -101,6 +101,13 @@ Revisit only if the stated reason stops holding.
   after `loadConfig`, which is before discovery imports any plugin module — the ordering is the whole
   point, so move it earlier if anything, **never later**. **Valid while plugins are
   operator-installed code, not third-party uploads.**
+- **`ory/postgres/init/init.sql` is the only home for the Ory databases' ACL.** Re-asserting the
+  `REVOKE CONNECT` from `bootstrap` each boot was tried and removed: `REVOKE` only *warns* when the
+  caller doesn't own the database, so under the least-privilege provisioning account the README
+  recommends it reported success while changing nothing — and it hard-failed whenever
+  `PLUGIN_DB_ADMIN_URL` named a server with no `kratos`. A volume created before that file gained the
+  revokes keeps the default grant; `docker compose down -v` is the dev remedy. **Valid while
+  pre-release, with no deployed volumes to migrate.**
 - **`bootstrap.ts` stays under `src/auth/`** even though it now provisions plugin databases as well
   as seeding Ory. It is the one-shot service's entrypoint, not an auth module; moving it to
   `src/bootstrap.ts` would edit `compose.yml`, five e2e compose files and `src/compose.test.ts` for a