skills: add CTE masking test to column-masking-auto-validation

This commit updates the column masking auto-validation skill to include
the new CTE masking test case.

Changes:
- Add tests/integrationtest/t/privilege/column_masking_cte.test to test plan
- Add P0-CORE-03 scenario for AT RESULT semantics with CTE
- Add it_column_masking_cte step to validation script

Co-Authored-By: Claude <noreply@anthropic.com>

Author: tiancaiamao

.agents/skills/column-masking-auto-validation/references/column-masking-test-plan.md

@@ -58,6 +58,7 @@ Execution policy:
 
 - Integration:
   - `tests/integrationtest/t/privilege/column_masking_policy.test`
+  - `tests/integrationtest/t/privilege/column_masking_cte.test`
 - Unit:
   - `pkg/ddl/masking_policy_test.go`
   - `pkg/planner/core/masking_policy_projection_test.go`

.agents/skills/column-masking-auto-validation/references/p0-scenario-matrix.json

@@ -235,6 +235,48 @@
       "steps": ["it_column_masking", "ut_planner"]
     }
   },
+  {
+    "id": "P0-CORE-03",
+    "scenario": "AT RESULT semantics with CTE",
+    "coverage_cases": [
+      {
+        "name": "Basic CTE masking (IT-MASK-P0-CTE-001)",
+        "file": "tests/integrationtest/t/privilege/column_masking_cte.test"
+      },
+      {
+        "name": "CTE with RESTRICT ON (IT-MASK-P0-CTE-002)",
+        "file": "tests/integrationtest/t/privilege/column_masking_cte.test"
+      },
+      {
+        "name": "CTE AT RESULT semantics (HAVING, ORDER BY) (IT-MASK-P0-CTE-003)",
+        "file": "tests/integrationtest/t/privilege/column_masking_cte.test"
+      },
+      {
+        "name": "CTE multiple references (IT-MASK-P0-CTE-004)",
+        "file": "tests/integrationtest/t/privilege/column_masking_cte.test"
+      },
+      {
+        "name": "CTE with current_role() (IT-MASK-P0-CTE-005)",
+        "file": "tests/integrationtest/t/privilege/column_masking_cte.test"
+      },
+      {
+        "name": "CTE with MASK_PARTIAL (IT-MASK-P0-CTE-006)",
+        "file": "tests/integrationtest/t/privilege/column_masking_cte.test"
+      },
+      {
+        "name": "CTE with CONCAT expression (IT-MASK-P0-CTE-007)",
+        "file": "tests/integrationtest/t/privilege/column_masking_cte.test"
+      },
+      {
+        "name": "Recursive CTE with masking (IT-MASK-P0-CTE-008)",
+        "file": "tests/integrationtest/t/privilege/column_masking_cte.test"
+      }
+    ],
+    "rule": {
+      "type": "steps_pass",
+      "steps": ["it_column_masking_cte"]
+    }
+  },
   {
     "id": "P0-RES-01",
     "scenario": "RESTRICT ON INSERT INTO ... SELECT",

.agents/skills/column-masking-auto-validation/scripts/run_validation.sh

@@ -110,6 +110,7 @@ if [[ "${SKIP_TESTS}" -eq 0 ]]; then
   run_step "ut_failpoint_disable" "make failpoint-disable"
 
   run_step "it_column_masking" "pushd tests/integrationtest >/dev/null && ./run-tests.sh -r privilege/column_masking_policy && popd >/dev/null"
+  run_step "it_column_masking_cte" "pushd tests/integrationtest >/dev/null && ./run-tests.sh -r privilege/column_masking_cte && popd >/dev/null"
   run_step "it_expression_builtin" "pushd tests/integrationtest >/dev/null && ./run-tests.sh -r expression/builtin && popd >/dev/null"
 
   if [[ "${WITH_LINT}" -eq 1 ]]; then