fix: report the database's refusal instead of guessing its cause

The health report's InsufficientPrivilege handler said 'the scheduler's
database user lacks INSERT on check_history'. That grant was in place. What was
actually missing was USAGE on check_history_id_seq — the sequence behind the
table's serial id — so an INSERT was refused for a reason the message did not
mention and actively contradicted.

Verified by attempting the insert directly as scheduler_user:
  ERROR: permission denied for sequence check_history_id_seq

A diagnostic that names a cause it did not observe is worse than a generic one:
it sends the reader to a fix that is already applied, and reads as evidence the
grant did not work. The message now prints psycopg2's own first line.

Co-Authored-By: Claude <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## [Unreleased]
 
+### Fixed
+- The health report's permission diagnostic prints the database's own message instead of
+  asserting a cause. It claimed the user lacked INSERT on `check_history` when that grant was
+  present and the missing one was USAGE on the sequence behind its serial id.
+
 ## [1.5.0] - 2026-08-11
 
 ### Added
@@ -282,6 +287,11 @@ TOTAL                            80% 🎯
 
 ## [Unreleased]
 
+### Fixed
+- The health report's permission diagnostic prints the database's own message instead of
+  asserting a cause. It claimed the user lacked INSERT on `check_history` when that grant was
+  present and the missing one was USAGE on the sequence behind its serial id.
+
 ## [1.5.0] - 2026-08-11
 
 ### Added

src/executors/health_report.py

@@ -97,14 +97,22 @@ def report(
                 )
         logger.info("health report: %s=%s recorded", domain, status)
         return True
-    except psycopg2.errors.InsufficientPrivilege:
+    except psycopg2.errors.InsufficientPrivilege as exc:
         # Named separately because it is the expected first failure and the fix
-        # is a one-line grant, not a code change:
-        #   GRANT INSERT ON check_history TO <scheduler user>;
+        # is a grant rather than a code change. The database's own message is
+        # printed verbatim rather than summarised: the first version of this
+        # asserted "lacks INSERT on check_history" and was wrong — the table
+        # grant was present and what was actually missing was USAGE on
+        # check_history_id_seq, the sequence behind its serial id. A diagnostic
+        # that names a cause it did not observe sends the reader to the wrong
+        # fix with confidence.
+        #
+        #   GRANT INSERT ON check_history TO <user>;
+        #   GRANT USAGE ON SEQUENCE check_history_id_seq TO <user>;
         logger.warning(
-            "health report for %s refused: the scheduler's database user lacks INSERT on "
-            "check_history. The task itself succeeded; only the report was lost.",
-            domain,
+            "health report for %s refused by the database: %s. The task itself succeeded; "
+            "only the report was lost.",
+            domain, str(exc).strip().splitlines()[0],
         )
         return False
     except Exception as exc:  # noqa: BLE001 - reporting must not raise