fix(sync): tolerate missing USAGE on the wal2delta schema

[taran-dbx]

Problem

Calling lakets.enable_sync(...) fails with:

SQL Error [42501]: ERROR: permission denied for schema wal2delta
Where: PL/pgSQL function lakets.enable_sync(text,text) line 15 at IF

enable_sync and the tiering durability gate probe wal2delta only to detect whether Lakebase CDF is active — they never write to it. The probe used to_regclass('wal2delta.tables'), which resolves a name inside the schema and therefore requires USAGE on it. Since wal2delta is owned by the CDF subsystem, a role without USAGE gets 42501 instead of the NULL the code assumed for "not present" — aborting enable_sync at its preflight IF.

Fix

• enable_sync — wrap the CDF probe in an exception handler; treat insufficient_privilege the same as "not visible" and warn-and-continue. The function does not otherwise touch wal2delta, so the shadow + trigger are created as normal.
• _cdf_committed_lsn (tiering gate) — drop the to_regclass pre-check and catch insufficient_privilege / undefined_table / invalid_schema_name, returning NULL so the gate fails closed — it never evicts data whose durability it cannot verify.
• docs — troubleshooting entry explaining the error and the GRANT USAGE … / GRANT SELECT … needed if you want CDF-gated tiering to actually evict.

Test plan

• make build is clean (14 modules, version 0.1.0)
• Exception conditions are fail-closed for the durability gate (no eviction without a verified committed LSN)
• Re-run enable_sync as a role without wal2delta USAGE → completes with a WARNING instead of 42501

Note: CI runs lint + Python unit tests; it does not execute SQL against a live Lakebase, so live verification of the privilege path is manual.