test(integration-tests): cover governance behavior

[mkuchenbecker]

Summary

This PR adds access-control policies, SQL grants, column tags, encryption
observability, and file-replication behavior on top of RTAS. It contributes 21
cases to the 394-case RTAS catalog and produces 415 combined cases.

This branch also fills the Governance section in TEST-COVERAGE.md.

Stack

Layer	Parent	Contribution	Combined	Pull request
RTAS	Standard DML	264	394	#744
Governance	RTAS	21	415	This PR

Scope

This layer owns table-level governance: SET and UNSET POLICY for sharing,
history, replication, and retention; rejected out-of-range history policies;
rejected grants on an unshared table; the grant, show, and revoke SQL cycle on
a shared table; column tags; encryption observability; and file-replication
properties.

Contribution	Cases
Access control and policy (ScenarioAccessControl.scala)	16
Column tags (ScenarioColumnTag.scala)	2
Encryption observability (ScenarioEncryption.scala)	2
File replication property (ScenarioFileReplication.scala)	1
Total	21

Known limitations

Case	Reason	Skipped
rtas.schema.incompatibleType.notSilentlyLossy, rtas.concurrency.replaceVersusAppend (Parquet, ORC)	These four skips are inherited from RTAS.	4
accessControl.grantAndRevoke (Parquet, ORC)	The embedded test server has no OPA endpoint, so the local run cannot observe ACL state. The li-openhouse acceptance environment runs the assertion against its configured authorization service.	2

Validation

Check	Result
git diff --check against the parent tip	Clean.
Added lines	ASCII only.
Embedded catalog	415 combined cases: 409 passed, 6 skipped, 0 failed.