Sub-ticket of MARS-119 DB: search_path hardening (lint 0011) — audit SECURITY DEFINER fn subset FIRST (privesc priority), then pin SET search_path=public on flagged fns; behavior-preserving; DDL via audit pre-apply · mars