Caller privilege tier, ordered least to most privileged.
Variant order is the privilege order and Ord is derived from it, so
caller >= required is the authorization comparison. This mirrors what
v0.2.10 did for PlanRiskLevel; CallerRole kept a hand-written
role_rank match until now, which is a second encoding of the same
ordering that could drift from this declaration.
Adding a variant means placing it at the correct privilege position, not
appending it.
Stable lowercase spelling, identical to the serde representation.
The audit chain signs this string, so it is a wire format: renaming a
variant must not silently change what past signatures were made over.
format!("{role:?}") cannot be used for that — Debug carries no
stability promise and tracks the identifier. caller_role_as_str_matches_serde
pins the two encodings together.