Inventory + lock down public function EXECUTE and sequence privileges (adjacent to MARS-416 relation-grant revoke)

audit-mars-ca flagged during MARS-416 DESIGN PASS review: the schema-wide anon/authenticated/PUBLIC relation-grant revoke (migration 027) does not close two adjacent Supabase default-grant surfaces — (1) function EXECUTE privileges on public schema functions, (2) sequence USAGE/SELECT privileges. Same default-grant exposure class as MARS-416 (Supabase auto-grants these to anon+authenticated on creation). Needs its own inventory (information_schema.routine_privileges + sequence privilege check) and its own REVOKE + ALTER DEFAULT PRIVILEGES migration, staged after MARS-416 lands. Same Class-A escalation path (audit pre-apply design review, Elazar go if any function/sequence turns out to be intentionally public e.g. RPC called from client anon key).