[Bug] Claude generates incomplete REVOKE statements for SECURITY DEFINER functions, leaving PUBLIC grants intact

**Bug Description**
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ ✻ Bug report drafted: Model wrote REVOKE ... FROM anon,authenticated believing it locked down a SECURITY DEFINER function, but PUBLIC grant remained │
│ │ What happened: While generating Supabase migrations I wrote revoke execute on function public.moderate_content(bigint, text) from anon, authenticated; for…

**Environment Info**
- Platform: darwin
- Terminal: ghostty
- Version: 2.1.251
- Feedback ID: bdd7ed48-38e6-4511-9a5d-f31398aef1fa

**Errors**
```json
[]
```

No source file, test, or entry point is named. Start by reproducing the described Supabase migration generation for a SECURITY DEFINER function and check whether PUBLIC retains its execute grant. Done means the generated statement correctly removes the unintended PUBLIC access.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.