portal: re-enable the parent (guardian) audience once portaliq ships scope-value joins #567

The student portal contribution shipped (PR #42). The parent audience was trimmed and deferred because portaliq's current one-hop via keeps outer rows by their own id (zaak/rol shape), which can't express guardian → child learnerRef → records-matched-by-learnerRef (a reverse/scope-value join). A parent manifest would fail-closed to empty — looks supported, shows nothing.

The additive schema refs are already in place (learner-profile.guardianRefs, excuse-request.submittedByRef from the portal-identity change), so re-enabling parent is a pure provider addition once portaliq lands scope-value joins (tracked in the portaliq repo).

When unblocked: re-add getAudiences() → ['student','parent'], the parentContribution() branch (grades/attendance/excuse reads via the scope-value join + the guardian-stamped ExcuseRequest create), and set parent grade/attendance reads to minTrust: substantial (a guardian authenticating to a minor's data — pairs with the eHerkenning/DigiD broker, openconnector#99). The trimmed provider + tests from PR #42 are the starting point (see git history).

Gemigreerd van Codeberg — oorspronkelijk Conduction/scholiq#43, geopend door rubenvdlinde op 2026-07-06.