This starts the RBAC split stack with parser and display support for PostgreSQL role syntax while keeping frontend behavior behind compile-safe unsupported paths. The later stack layers add storage, meta authority, frontend behavior, session semantics, and catalog compatibility.\n\nConstraint: New parser enum variants must not break downstream exhaustive matches before behavior lands.\nRejected: Include full frontend role handling in this parser PR | would collapse the planned review boundary.\nConfidence: high\nScope-risk: narrow\nTested: cargo fmt --check; cargo test -p risingwave_sqlparser granted_by --test sqlparser_common; cargo check -p risingwave_frontend\nNot-tested: Full workspace CI and runtime SQL behavior; covered by later stack PRs

Avoid treating option-keyword role names as REVOKE <option> OPTION FOR unless OPTION follows, so names like admin, inherit, and set remain valid role targets.

Constraint: PR #25521 only exposes parser surface and should keep the fix localized to sqlparser.
Rejected: reserving admin/inherit/set as role-option prefixes unconditionally | PostgreSQL role names can use these words and the parser already supports identifier role targets.
Confidence: high
Scope-risk: narrow
Directive: Keep role-option detection lookahead-based so role names are not consumed before the clause is proven.
Tested: cargo fmt --check; cargo test -p risingwave_sqlparser parse_revoke_role_named_option_words_without_option_clause --test sqlparser_common; cargo test -p risingwave_sqlparser parse_revoke_set_option_for_role --test sqlparser_common; cargo test -p risingwave_sqlparser granted_by --test sqlparser_common
Not-tested: full workspace check

Role membership GRANT/REVOKE was selected only when the first token was not a privilege keyword, so roles named connect, create, select, or usage could be created but not granted or revoked unquoted. The parser now disambiguates by the statement shape: object privileges must reach ON before the role separator, while membership statements reach TO/FROM first.\n\nConstraint: This PR is the parser-surface lane for a stacked RBAC rollout; runtime RBAC semantics remain out of scope.\nRejected: Ban privilege-keyword role names | CREATE ROLE already accepts them and quoted-only follow-up would make the parser contract inconsistent.\nRejected: Full checkpoint fallback parse | broader control-flow change than needed for this grammar split.\nConfidence: high\nScope-risk: narrow\nTested: cargo fmt --check; cargo test -p risingwave_sqlparser --test sqlparser_common; cargo test -p risingwave_sqlparser --test parser_test; manual sqlparser probes for role and object-privilege GRANT/REVOKE\nNot-tested: Full workspace check

Copilot noted that the parser-surface lane documented stale YAML coverage and lacked tests for the staged user-handler boundary around role options. Keep the documentation aligned with the actual role/drop parser fixtures and add focused frontend tests that the newly parsed CREATEROLE/INHERIT variants still fail explicitly until runtime RBAC lanes implement them.\n\nConstraint: This PR should not implement runtime role-option semantics.\nConfidence: high\nScope-risk: narrow\nTested: cargo fmt --check; cargo test -p risingwave_frontend test_create_user_rejects_role_options --lib; cargo test -p risingwave_frontend test_alter_user_rejects_role_options --lib; cargo test -p risingwave_sqlparser --test parser_test -- role.yaml; cargo test -p risingwave_sqlparser --test parser_test -- drop.yaml\nNot-tested: Full ./risedev c