Migrate existing scope ownership data to the Virtual Scope model

Migrate ownership data currently stored directly in association_scopes_entities into the Virtual Scope chain (scope -> virtual_scope -> entity) so every pre-existing scope/entity relationship is represented via virtual_scopes, scope_bindings, and entity_memberships.

Scope
- Write and run a data migration covering every existing (scope_type, scope_id, entity_type, entity_id) row.
- Create a virtual_scopes row and a self scope_binding for every pre-existing owner scope (so the VirtualScopeNotFound invariant holds for old data).
- Backfill scope_bindings for existing scope->owner links and entity_memberships for existing owner->child ownership; move ref shares to invitee-VS entity_memberships with a permission_cap.
- Verify no ownership/permission regressions after migration (bidirectional ownership queries return the same results pre/post migration).

Depends on BA-6567 (Virtual Scope model/BEP) and BA-6656 (Apply Virtual Scope logic to all existing scope types).

[Aligned to BEP-1062 (#12842): correct table names are virtual_scopes / scope_bindings / entity_memberships (previously scope_virtual / virtual_entity, which do not exist in code); resolution is non-recursive.]

JIRA Issue: BA-6657

Start by reading BA-6567 and BA-6656, then review BEP-1062 (#12842) for the finalized Virtual Scope model and table names. Implement and run the data migration for every existing ownership row, then verify that bidirectional ownership and permission queries return the same results before and after migration.

Written by the indexing model from the issue text.