Admin roles are auto-assigned to users joining a scope (auto_assign should be false)

Admin roles are incorrectly marked with auto_assign = true, so they are automatically granted to every user who joins the owning scope.

Background: an earlier data migration backfilled auto_assign = true for all system-sourced roles (WHERE source = 'system'). Admin roles (name ending in 'admin') are system-sourced and were therefore included in that backfill.

Impact: any user joining a project or domain scope automatically receives that scope's admin role, gaining unintended administrative permissions. Expected behavior: admin roles must have auto_assign = false so they are never auto-granted on scope join.

Affected: roles table, auto_assign column, for roles whose name ends with 'admin'. Needs correction on both main and the 26.4 release line.

JIRA Issue: BA-6861

Start by locating the data migration that backfilled auto_assign for system-sourced roles and inspect the roles table handling for names ending in "admin". Confirm the correction is applied on both the main and 26.4 release lines, with admin roles left non-auto-assigned so users do not receive them on scope join.

Written by the indexing model from the issue text.