fix(datatables): refuse to roll back the catalog while roles exist

The down migration dropped the table and left every role behind: live Postgres
logins whose passwords only that table carried, so after a revert Windmill could
neither use, disable nor delete them, and re-applying could not recreate them
because the names were taken. Cleaning up here is not possible either — dropping
a role means reassigning what it owns in every instance database, and a
migration runs in one — so it now refuses while the catalog is non-empty and
says to delete the roles through instance settings, which does the cluster work.

Also enforces the instance-only invariant the resolved-pointer clone relies on
rather than only asserting it in a comment.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BjfMkJyKzodxkobqGZ6Lqb

backend/windmill-api-workspaces/src/workspaces.rs

@@ -7922,16 +7922,30 @@ async fn apply_forked_datatable(
     // (`point_kept_datatables_at_parent`), so the resolved entry is one.
     let database = match dt.database.clone() {
         Some(database) => database,
-        None => resolve_governing_datatable(db, parent_w_id, &fdt.name)
-            .await?
-            .datatable
-            .database
-            .ok_or_else(|| {
-                Error::internal_err(format!(
-                    "Data table '{}' resolves to an entry that owns no database",
+        None => {
+            let resolved = resolve_governing_datatable(db, parent_w_id, &fdt.name)
+                .await?
+                .datatable
+                .database
+                .ok_or_else(|| {
+                    Error::internal_err(format!(
+                        "Data table '{}' resolves to an entry that owns no database",
+                        fdt.name
+                    ))
+                })?;
+            // The resource branch below rewrites a resource this workspace owns; a pointer names
+            // one it does not, so following it there would move the fork onto someone else's
+            // database. Checked rather than assumed: only `point_kept_datatables_at_parent`
+            // writes pointers and only for instance entries, but nothing here enforces that.
+            if resolved.resource_type != DataTableCatalogResourceType::Instance {
+                return Err(Error::BadRequest(format!(
+                    "Data table '{}' points at a resource-backed data table in another \
+                     workspace and cannot be cloned; fork it from the workspace that owns it.",
                     fdt.name
-                ))
-            })?,
+                )));
+            }
+            resolved
+        }
     };
 
     if database.resource_type == DataTableCatalogResourceType::Instance {