Record idle checker assignments as scope-VS entity memberships with permission cap

On assignment CREATE, write an entity_membership (entity_type=idle_checker, entity_id=checker_id, permission_cap=UPDATE) into the target scope's virtual scope; remove it on DELETE. Replaces the deprecated RBACEntityCreator registration of binding UUIDs.

- Use the new EntityCreator from repositories/base/rbac/entity/ (PR #13579, BA-7262) - START AFTER #13579 MERGES
- Verify the new EntityCreator supports a membership permission_cap; extend it if not
- First production use of permission_cap
- The rc-era row cleanup migration and cap verification tests are a separate issue

## Success Criteria
- [ ] create assignment: membership row exists in the target scope VS with cap=UPDATE
- [ ] delete assignment: membership removed; other scopes' memberships for the same checker untouched
- [ ] no idle_checker_assignment-typed membership is created anymore
- [ ] pants test passes for affected packages

JIRA Issue: BA-7237

Start after PR #13579 merges, then read the new EntityCreator under repositories/base/rbac/entity/ and locate the idle-checker assignment create and delete paths. Verify whether EntityCreator supports membership permission_cap, extending it if needed. Run pants test for the affected packages; done means create/delete affects only the target scope membership with cap=UPDATE and creates no idle_checker_assignment-typed membership.

Written by the indexing model from the issue text.