EVO-71 mars: sweep live public fns for residual PUBLIC/anon/authenticated EXECUTE (supautils force-grant bypasses ALTER DEFAULT PRIVILEGES) + object-class probe

EVO-71 (Elazar-greenlit, same-day security). Root cause (pluto/audit-pluto-ca): Supabase supautils.hint_roles force-grants PUBLIC EXECUTE on every new public fn regardless of ALTER DEFAULT PRIVILEGES — the default-revoke is a no-op, so any SECURITY DEFINER fn reading secrets/vault that leaned on it is currently PUBLIC-callable. Mars believed clean (mig 019 revoked cron_auth_header PUBLIC + INVOKER guard on drain fn) but must confirm no OTHER fn regressed. Three parts: (1) LIVE SWEEP — audit every live public fn created after mars's default-privilege-revoke migration for residual PUBLIC/anon/authenticated EXECUTE; remediate with explicit same-transaction REVOKE ALL FROM PUBLIC/anon/authenticated; PRIORITIZE SECURITY DEFINER fns touching secrets/vault; report count found + remediated. (2) OBJECT-CLASS PROBE — create disposable postgres-owned probe objects (one NEW public TABLE + one SEQUENCE), check if they also get force-granted PUBLIC; report yes/no (if yes, fleet extends the explicit-REVOKE rule by object class). (3) Confirm going-forward: every fn migration incl CREATE OR REPLACE carries explicit REVOKE ALL FROM PUBLIC/anon/authenticated + grants only to intended roles; prefer SECURITY INVOKER where it removes the exfil class. Remediation REVOKEs are fail-closed/reversible; audit-mars-ca pre-apply DDL review on the remediation migration. Report child results to pm-mars-cc.