Static guard: mandatory three-way REVOKE (PUBLIC, anon, authenticated) on every public function-creating migration

gitpush.sh has no check that a new CREATE FUNCTION in a migration carries the three-way REVOKE ALL ... FROM PUBLIC, anon, authenticated + terminal ACL assertion. PLUTO-612/613 live repro proved supautils can force-grant anon/authenticated EXECUTE independently of pg_default_acl, surviving a PUBLIC-only revoke. Add a coder-owned .gitpush-pre.sh lint that flags a CREATE FUNCTION lacking the three-way revoke. Class-S tooling, non-blocking. Origin: audit-pluto-ca cross-app follow-up + db-venus-cc proposal 2026-07-19.