Three connected regressions surfaced by the new DB-backed list path
on the invariant_reconciliation_actor scenarios:
- `InvariantService.add_invariant()` had no way to set `non_overridable`,
so the BDD step `step_add_non_overridable_global` was bypassing the
service entirely (writing straight into `_invariants`). Once the
service became DB-backed for ad-hoc constructors, those direct dict
writes were invisible to `list_invariants()` and the reconciler saw a
regular global invariant.
- `InvariantModel.to_domain()` was dropping the `non_overridable` column
on read — it persisted correctly via `from_domain` but the round-trip
silently lost the flag.
- The step file imported `Invariant` + `ULID` only for the bypass that
is now gone; `ULID` is dropped, `Invariant` stays (still used in the
`isinstance` assertion further down).
ISSUES CLOSED: #8573
HAL9000
ea967142df