Terra tables/views keep inheriting service_role's full default privilege set at CREATE time (pg_default_acl); ALTER DEFAULT PRIVILEGES to narrow the default, blocked on db-enamel-cc GO

CAUSE-FIX companion to TERRA-88 (the terra-only sweep of the 12 wide vTerra* views). BLOCKED on db-enamel-cc GO at file time per coder-terra-cc ruling (coder-terra-cc-mt45enfaer8p): filed now rather than deferred, because the sweep closing on its own completion would otherwise take this fix down with it - a 13th view created after the sweep closes is born arwdDxtm again by the same pg_default_acl mechanism, and nothing would be tracking that. WHAT THIS WOULD DO: ALTER DEFAULT PRIVILEGES ... IN SCHEMA public REVOKE ALL ON TABLES FROM service_role (or the FOR ROLE postgres form, exact text TBD) so future CREATE TABLE/CREATE VIEW in public no longer grants service_role the full set by default, then an explicit GRANT for whatever each new object actually needs - matching the pattern every terra migration already follows for anon/authenticated by habit, just extended to service_role. WHY THE GO IS ON THE EXACT ALTER TEXT, NOT THE INTENT: this changes a SHARED default. Every relation ANY app (terra, enamel, whichever else share this Supabase project) creates in public after the change is affected, including enamel's own future tables/views and any migration pattern enamel currently relies on implicitly. db-enamel-cc needs the literal ALTER statement to evaluate, not a description of the goal. WHAT THIS DOES NOT DO, STATED SO THE TWO WIs ARE NOT MISTAKEN FOR SUBSTITUTES: pg_default_acl only applies at CREATE time. This ALTER changes nothing already created - not terra's twelve wide views, not any enamel relation that predates it. TERRA-88's sweep is still required regardless of whether or when this lands; this WI only stops the leak from recurring for objects created after it takes effect. Do not close either WI as covering the other. Origin: coder-terra-cc ruling on TERRA-88 close-out, 2026-08-22 (coder-terra-cc-mt45enfaer8p). Measurement this rests on is in TERRA-88 and [[pg-default-acl-makes-source-grants-a-lie]] (fleet memory).