test(02-12): cover defensive record presentation

- reject inconsistent access levels before chrome can elevate them\n- fall back to the caller record for malformed payloads

src/__tests__/shared-record-navigation.test.tsx

@@ -114,4 +114,22 @@ describe("shared-record navigation", () => {
       }),
     ).toEqual({ access: "manage", recordKind: "managed" });
   });
+
+  it("fails closed when a malformed entry reaches presentation", () => {
+    expect(
+      resolveRecordPresentation({
+        level: "manage",
+        canWrite: false,
+        recordKind: "managed",
+      } as never),
+    ).toEqual({ access: "view", recordKind: "self" });
+
+    expect(
+      resolveRecordPresentation({
+        level: "unknown",
+        canWrite: true,
+        recordKind: "shared",
+      } as never),
+    ).toEqual({ access: "view", recordKind: "self" });
+  });
 });