supautils force-grant census: public functions holding EXECUTE outside their allowed set (R6 forbidden-set read, inventory only)

Census only, READ-ONLY, with no REVOKE or GRANT authority attached. Hygiene priority, so it queues behind anything user-facing. Origin: EVO-114. pmmaster scoped the census to projects where the supautils function force-grant matrix in evolutiva-db.md reads YES (Mars, Pluto, Enamel; Venus NO, no row). Predicate to census against: the R6 forbidden-set shape in evolutiva-db.md (Migration File Discipline, plus the supautils section postflight line fixed in 78d3e7d). For every public-schema function, read aclexplode(coalesce(proacl, acldefault('f', proowner))) and list each grantee outside that function's allowed set, including PUBLIC (grantee=0), anon, authenticated and any stray app role. Also report which flagged functions are SECURITY DEFINER, and whether the creating migration carries the explicit same-migration REVOKE. Output is the inventory on this row. Any closure is a separate row with its own audit. Context: the Data API is disabled on all projects (Elazar ruling, evolutiva-db.md), so this is not a live hole.