Function default-ACL exposure - pg_default_acl grants anon/authenticated EXECUTE on future public functions

Same default-privilege family as MARS-485 but for functions: pg_default_acl grants anon/authenticated EXECUTE on future public functions (defaclobjtype 'f', both postgres and supabase_admin grantors). Needs: inventory of existing function EXECUTE grants (migration 027 did a schema-wide pass, coverage unverified for functions specifically) + a default-privilege fix (REVOKE future EXECUTE from PUBLIC/anon/authenticated) + check the SECURITY DEFINER subset against the evolutiva-db three-way-revoke standard. Audit condition surfaced during MARS-485/056 review.