Function install_public_authorizer 

pub fn install_public_authorizer(
    conn: &Connection,
    class: StatementClass,
) -> PublicAuthorizerGuard<'_>

Install the reserved-object authorizer on conn for the lifetime of the returned guard. The authorizer denies any statement that touches a reserved _rindle_* / hct_* / sqlite_* object (and any connection-local action — ATTACH/PRAGMA/DETACH), matching the fail-closed rule the public /v1/sql/* execute path already enforces. Exposed so callers outside this module (the mutation facade’s raw statement executor) can bracket a bare conn.execute with the same guard the run_statement path uses. class is the statement class being run.