Sub-ticket of MARS-523 EVO-71 tooling reference: author fn-REVOKE enforcement — (1) .gitpush-pre.sh static guard flagging CREATE [OR REPLACE] FUNCTION lacking same-tx REVOKE EXECUTE FROM PUBLIC/anon/authenticated + (2) post-apply catalog assertion (proacl excludes PUBLIC/anon/authenticated on new public fns) · mars