Sweep pre-086 owner-rights agent-granted views to security_invoker=true

Surfaced by db-mars-cc during MARS-560/mig-090. vStudentTeacherRoster, vJtpCandidates (and any other pre-086 agent-granted views reading agent-readable bases) are still owner-rights, violating the mig-086 security_invoker standard that mig 090 just applied to vComisionPickedTeachers. Functionally inert today (grantees hold base SELECT) but latent ACL-escalator shapes by the 086 rule. Fix: inventory all pre-086 agent-granted views + ALTER ... SET (security_invoker=true) in one migration. Cheap ALTER-only. Class-A (touches view ACL posture) — audit review on the inventory + DDL. Not urgent.