Schema: `role` excluded from `constrained_by` and `governed_by` source types

[Mearman]

Problem

Role nodes cannot be the source of constrained_by or governed_by relationships. This prevents expressing that a role is constrained by an invariant or governed by a principle.

Reproduction

sysprom add role --name "Tenant user"
sysprom add invariant --name "Data isolation per tenant"
sysprom add principle --name "Understand before acting"

sysprom update add-rel ROLE1 constrained_by INV1
# Error: Invalid endpoint types for constrained_by: role → invariant.
# Valid: [intent, concept, capability, element, realisation, decision, change, invariant] → [...]

sysprom update add-rel ROLE2 governed_by PRIN1
# Error: Invalid endpoint types for governed_by: role → principle.
# Valid: [intent, concept, capability, element, realisation, stage, gate, change, policy, artefact] → [...]

Use case

Roles are natural targets for governance and constraints:

• "The AI Assistant agent role is constrained by the read-only AI queries invariant"
• "The AI Assistant agent role is governed by the understand-before-acting principle"

These are meaningful provenance relationships that currently can't be expressed.

Suggestion

Add role to the valid source types for constrained_by and governed_by.