feat: harden governed runs and add dashboard integration

src/govoplan_dataflow/backend/governance.py

@@ -67,7 +67,7 @@ def normalize_definition_scope(
         return principal.tenant_id, "group", clean_id
     if clean_type == "user":
         if not clean_id:
-            clean_id = principal.membership_id or principal.account_id
+            clean_id = principal.account_id
         if (
             clean_id not in {principal.membership_id, principal.account_id}
             and not administrative
@@ -75,6 +75,8 @@ def normalize_definition_scope(
             raise PermissionError(
                 "Definitions can only be created for the current user."
             )
+        if clean_id == principal.membership_id:
+            clean_id = principal.account_id
         return principal.tenant_id, "user", clean_id
     raise ValueError(
         "Definition scope must be system, tenant, group, or user."