#3785 typed-secrets: the accessor adapter reads a legacy row stamped with the empty namespace as foreign, so its tagged fields stay reference text on the typed path

Problem

The accessor adapter (src/infrastructure/cel/sensitive_record_adapter.ts, adaptDataRecord) returns a record as stored, its tag unread, whenever ownNamespace is defined and record.namespace differs from it. The data layer reads a row stamped with the empty namespace as the repository's own (isForeignNamespace in src/domain/data/repositories.ts: the empty namespace is foreign only when the fetcher reads the solo namespace). A row written before the repository set a namespace therefore counts as the reader's own to the query service and the content paths, but as foreign to the adapter.

On the typed path (behind the internal option today; every entry point after the release flip of design Section 10.3) such a row's tagged fields reach CEL as the stored reference text instead of data-origin Secrets: nothing records or authorizes them, nothing loads them at delivery, and a method handed one receives the literal reference text where it receives the secret today through the untyped resolution.

Affects every accessor (data.latest, data.version, findBySpec, findByTag, model..resource, model.method) and, once typed-secrets 4.3 (swamp-club#3732) ships, data.query, whose whole-catalog predicates meet legacy rows far more readily than a named read.

Expected

The adapter decides own versus foreign with the same rule as the data layer: a row stamped with the empty namespace is the reader's own unless the repository's fetcher reads the solo namespace. Pin it with an empty-namespace row in integration/typed_data_secrets_test.ts.

Found during the adversarial review of swamp-club#3732 (plan v2, finding ADV-14).