EVO-123: convert 10 UPDATE OF invariant guards to AFTER/no-column-list

EVO-123 / evolutiva-db.md R5. Convert each final-row-invariant UPDATE OF guard: no column list, OLD.x IS DISTINCT FROM NEW.x in body, AFTER (or constraint trigger), forced-red arm where a neighbouring BEFORE trigger does the rewrite. Write-shaping triggers keep UPDATE OF. Latent today (no rewriter found), hence p2; raise if a migration adds a BEFORE trigger that assigns a watched column. Done = every guard listed converted and its forced-red arm recorded. Guards (migration files, 10): groups forbidOwnerNarrowing, guardDeactivation; lookupOptions forbidOrphaningScopeMembers; pacienteAntecedentes requireDetalle; supportTickets statusMatrix; userGroups forbidGrantForDeletedUser, forbidGrantForInactiveGroup, forbidGroupAppKeyMismatch, guardEnamelAdminMinimum (draft 085 / ENAMEL-81 converts 3 of these); vocabularyScopeMembers integrityGuard. recordEmailHistory keeps UPDATE OF. Confirm against the live catalog.