Hide provider Ensure Schema SPI from generated workspaces

[philipgreat]

Application code must invoke Ensure Schema through UserContext. Database executors remain infrastructure, but direct executor.ensureSchema(context) calls must be rejected by a context-owned capability boundary. Update generated workspaces and add negative-access regression coverage.