Sub-ticket of EVO-114 supautils force-grants EXECUTE on new functions to PUBLIC/anon/authenticated despite default-privilege revocation - every Evolutiva CREATE FUNCTION needs an explicit same-migration REVOKE, and no commons file says so · evolutiva