Remove anon default table privileges on production #470

Summary

Production never ran 29-lint-hardening.sql §3, so anon still holds default table privileges on production tables outside the 2026-09-28 hand fix. #316 covers only objects created in the future.

• Exposure: RLS still applies to every table that has it on, so anon reads stay limited by policy. The gap is any table without RLS, and any future table that ships without its own revoke.
• Source: the Port the 2026-09-28 prod grant and RLS fix into scripts and a paired migration #314 review, 2026-10-08 (packages/supabase/CLAUDE.md, the "Production never ran" bullet).

Fix

1. Read-only on prod: list every table in public where anon has INSERT, UPDATE, DELETE or TRUNCATE, and every table with relrowsecurity = false.
2. Write one migration that revokes anon writes everywhere except where a policy needs them. Keep the anon SELECT allowlist from §6 and §7.
3. Mirror it in the scripts, and regenerate seed.sql.

Acceptance

• The read-only listing is posted here before and after.
• No anon write privilege remains on a table without a policy that needs it.