feat: refuse budget grants while a minor has no verified guardian

[jaspermayone]

Krater grants no budget to a project while a team member is under 18 without a verified guardian in Weave.

An email link proves only that someone reads an inbox, not that they are a parent. So a Weave admin records a stronger check in Weave: a signed guardian form and a call or video check. Krater stores none of this. It reads the Weave directory fresh at decision time, as it does for roles.

Depends on the Weave stack, mainly patchworklabsorg/weave#195 (minor) and patchworklabsorg/weave#196 (guardian_verified). Merge order does not matter: a record without minor counts as "not known to be a minor".

flowchart TD
  A[Approve proposal, raise ceiling, or admin budget increase] --> B[Fresh directory lookup for each team member]
  B -->|Weave down| X[Refuse: try again]
  B --> C{Directory answer}
  C -->|404| D[Block: not available in Weave]
  C -->|minor and not guardian_verified| E[Block: no verified guardian]
  C -->|no minor field| F[Allow, log a warning]
  C -->|adult, or minor with verified guardian| G[Allow]

Loading

Changes

• WeaveUser gets minor and guardian_verified. The stub fixture has two minor users and helpers to change them.
• krater/services/guardian.py holds the rule. krater/services/projects.py calls it before every grant: a proposal approval, an amendment approval that raises the ceiling, and an admin budget increase.
• The team is the submitter plus the credited builders on the revision being decided.
• A directory 404 blocks the grant. Weave hides a minor whose consent is missing or revoked, so a 404 must not let a grant through.
• There is no admin override. The web and Slack Approve paths both go through record_review. A refusal rolls back the whole decision and lists the members with the reason.
• record_review, admin_decide and admin_adjust_budget now require weave_client, so no caller can skip the check. About 60 test call sites changed for that.
• The project page shows the members who need a verified guardian.
• docs/SPEC.md and docs/weave-integration.md describe the rule.

Open point

The page notice is visible to the submitter as well as to reviewers and admins.