feat: harden governed runs and add dashboard integration

tests/test_service.py

@@ -23,6 +23,7 @@ from govoplan_dataflow.backend.db.models import (
     DataflowPipelineRevision,
     DataflowRun,
 )
+from govoplan_dataflow.backend.governance import normalize_definition_scope
 from govoplan_dataflow.backend.schemas import (
     GraphEdge,
     GraphNode,
@@ -140,6 +141,18 @@ class FakeRegistry:
 
 
 class DataflowServiceTests(unittest.TestCase):
+    def test_user_scope_normalizes_membership_to_account_id(self) -> None:
+        tenant_id, scope_type, scope_id = normalize_definition_scope(
+            principal(),
+            scope_type="user",
+            scope_id="membership-1",
+            administrative=False,
+        )
+
+        self.assertEqual("tenant-1", tenant_id)
+        self.assertEqual("user", scope_type)
+        self.assertEqual("account-1", scope_id)
+
     def setUp(self) -> None:
         self.engine = create_engine("sqlite:///:memory:")
         Base.metadata.create_all(