Preview branches do not preserve object privileges in public, and do not create auth.users triggers

## Summary Creating a preview branch produces a database whose **schema** matches its parent but whose **privileges and `auth`-schema triggers do not**. Two distinct losses, measured, reproducible on every branch we create: 1. **Object privileges are not preserved.** `GRANT`/`REVOKE` state on `public` functions and tables is replaced by what the schema's default privileges produce, so roles hold access the parent revoked. 2. **Triggers on `auth.users` are not created.** A trigger the parent carries is simply absent. The first is a security-relevant divergence: on our branches `anon` holds every privilege on tables the parent revokes it from, and `authenticated` can execute functions the parent restricts to `service_role`. ## Environment | | | |---|---| | Branch created via | `POST /v1/branches` (Management API), `with_data: false` | | Instance size | `ci_micro` | | PostgreSQL | 17.6 | | Schema size | 285 migrations · 385 `public` functions · 98 `public` tables · 118 RLS policies | ## Defect 1 — object privileges are not preserved ### Expected A branch's `public` objects carry the same `relacl` / `proacl` as the parent's. ### Actual They carry what the schema's default privileges produce. Measured on a fresh branch, comparing raw ACLs: | object class | rows compared | differ from parent | |---|---|---| | function ACLs | 385 | **204** | | table ACLs | 98 | **45** | Representative examples — parent first, branch second: ``` activate_tenant(uuid) parent: postgres=X/postgres, service_role=X/postgres branch: postgres=X/postgres, anon=X/postgres, authenticated=X/postgres, service_role=X/postgres contacts parent: postgres=arwdDxtm, authenticated=arwdDxtm, service_role=arwdDxtm branch: … plus anon=arwdDxtm ← every privilege, on a table the parent revokes anon from call_disposition_catalog parent: authenticated=r ← read only branch: authenticated=arwdDxtm ← full write ``` ### What IS preserved Worth stating, because it narrows the …