Harden cron_auth_header(): REVOKE EXECUTE FROM PUBLIC + lock search_path

mig017's cron_auth_header() is SECURITY DEFINER, returns the CRON_SECRET bearer, and PUBLIC EXECUTE was never revoked (default Postgres grant). Confirmed live: has_function_privilege('anon'/'authenticated'/'public', ..., 'EXECUTE')=true. Mars ships the anon/publishable key client-side (NEXT_PUBLIC_SUPABASE_PUBLISHABLE_DEFAULT_KEY in login flow), so if the Data API RPC path is reachable, any browser session could call rest/v1/rpc/cron_auth_header and exfil CRON_SECRET. Live RPC test currently returns 503 PGRST002 schema-cache error (not a confirmed-safe disable, could self-heal). Fix: REVOKE EXECUTE ON FUNCTION cron_auth_header() FROM PUBLIC + SET search_path=pg_catalog,vault + fully-qualify vault.decrypted_secrets call. New numbered migration, not an edit to mig017.