fix(09): WR-09 scaffold admin controllers with a required permission and a record source placeholder

internal/build/build_test.go

@@ -769,6 +769,12 @@ func TestScaffoldAllArtifacts(t *testing.T) {
 		`ID() string        { return "golem15.demo.albums" }`,
 		`ModelName() string { return "Albums" }`,
 		`ConfigDir() string { return "controllers/albums" }`,
+		// WR-09: the scaffold is never open to every administrator and names
+		// its record source, so completing it cannot silently expose the data.
+		`pact.AdminPermissioned = albumsAdmin{}`,
+		`RequiredPermissions() []string`,
+		`return []string{"golem15.demo.access_albums"}`,
+		`NewRecord() any { return nil }`,
 	} {
 		if !bytes.Contains(adminSrc, []byte(want)) {
 			t.Fatalf("albums.go missing %s:\n%s", want, adminSrc)