RBAC backfill migrations delete operator-managed permission rows on downgrade

## Objective

Make the downgrade() of RBAC backfill migrations a no-op so that downgrading never destroys permission rows that operators created at runtime.

## Background

15 migrations seed the permissions / association_scopes_entities / object_permissions tables for a new entity type (session, vfolder, agent, image, keypair, artifact, artifact_registry, container_registry, resource_group, app_config, model_deployment, model_card, notification_channel, notification_rule, admin pages).

Their downgrade() removes rows with a blanket DELETE ... WHERE entity_type = %s. Once the runtime starts using an entity type, operators grant/revoke permissions and attach entities to scopes of their own. Those rows are indistinguishable from the seeded ones, so a downgrade silently erases real, operator-managed grants — including the object permissions backing live vfolder invitations. The data is unrecoverable, and a subsequent upgrade only re-creates the seed, not the operator grants.

Several sibling migrations already treat this class of backfill as forward-only (6e5a7a62a687, 3632aad9d5d9, f2b9a4c7e103, 5a4e677aea42, e3fb172166dc). This issue applies the same precedent to the remaining ones.

## Acceptance Criteria

- downgrade() of every RBAC backfill migration is a no-op with a short comment explaining why it is forward-only.
- The now-dead delete/revert helper functions are removed rather than left unreferenced.
- No permission, association_scopes_entities, or object_permissions row is deleted or mutated by any of these downgrades.
- Schema-reverting migrations (constraints, columns, tables) keep their existing downgrade behaviour and are out of scope.
- pants fmt / lint / check pass on the changed files.

JIRA Issue: BA-6896

Start by locating the remaining RBAC backfill migrations and compare their downgrade() methods with the forward-only migrations 6e5a7a62a687, 3632aad9d5d9, f2b9a4c7e103, 5a4e677aea42, and e3fb172166dc. Verify that each targeted downgrade is a no-op, remove its dead delete/revert helpers, and run pants fmt, lint, and check on the changed files.

Written by the indexing model from the issue text.