feat(policy): add the observer role below member - #2543

🟡 Confidence 6/10 · needs attention. Held at 6 because a correctness warning is open.
_{1 warning −1 · tests covered · risk high −1}

Adds observer below member, makes an unknown role string read as observer instead of member, and rewords the member denial. The policy ladder itself is sound; the Members page's existing role reader reports an observer as a member.

• observer joins Role and RANK below member under key org:observer
• roleOf answers observer for any role string it does not know
• highestRole keeps the member floor only for an empty role set
• holdersPhrase for a member permission names admins, engineers and members

Before merge

• Manual · Create the org:observer role in the Clerk development and production instances, or roleOf will never see the key

Findings

Let `org-membership` resolve the observer entry (label "Observer") while keeping it out of `ROLE_ENTRIES`, so the row is not reported as a member and a Member pick still saves.

_{bdcd2bc · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}