EVO-71 (security P1): sweep public fns for supautils force-granted PUBLIC EXECUTE + object-class probe

Fleet EVO-71. Supabase supautils.hint_roles force-grants PUBLIC EXECUTE on every new public fn regardless of ALTER DEFAULT PRIVILEGES — so REVOKE-on-default is a no-op and any SECURITY DEFINER fn reading secrets/vault that relied on it is currently PUBLIC-callable (live hole). Directly implicates venus fn_drainEmailOutboxGuard (venus51, SECURITY DEFINER reads vault) + the in-flight VENUS-287 trigger fn. Tasks (db-venus): (1) LIVE SWEEP every public fn created after venus's default-privilege-revoke migration for residual PUBLIC/anon/authenticated EXECUTE; explicit same-txn REVOKE remediation, prioritize SECURITY DEFINER secret/vault fns; report count found+remediated. (2) OBJECT-CLASS PROBE: disposable postgres-owned NEW public TABLE + SEQUENCE — do they also get force-granted PUBLIC? report yes/no. (3) Confirm forward rule: every fn migration (incl CREATE OR REPLACE) carries explicit REVOKE ALL FROM PUBLIC/anon/authenticated + grants only to intended roles; prefer INVOKER. Same-day.