[Bug] Claude generates incomplete REVOKE statements for SECURITY DEFINER functions, leaving PUBLIC grants intact

**Bug Description**
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ ✻ Bug report drafted: Model wrote REVOKE ... FROM anon,authenticated believing it locked down a SECURITY DEFINER function, but PUBLIC grant remained │
│ │ What happened: While generating Supabase migrations I wrote revoke execute on function public.moderate_content(bigint, text) from anon, authenticated; for…

**Environment Info**
- Platform: darwin
- Terminal: ghostty
- Version: 2.1.251
- Feedback ID: bdd7ed48-38e6-4511-9a5d-f31398aef1fa

**Errors**
```json
[]
```

No source file, test, or entry point is named. Start by reproducing the described Supabase migration generation for a SECURITY DEFINER function and check whether PUBLIC retains its execute grant. Done means the generated statement correctly removes the unintended PUBLIC access.

Rédigé par le modèle d'indexation à partir du texte de l'issue.