Migrate image entity membership to the Virtual Scope model

Image entities currently record their scope membership through direct association_scopes_entities writes. Migrate this to the Virtual Scope chain (scope -> virtual_scope -> entity) so image ownership is represented via entity_memberships under the owning scope's virtual scope.

- Re-wire the image entity registration paths (creation/rescan) to write entity_memberships via the RBAC ops provider instead of direct association_scopes_entities rows.
- Ensure the owning scope has a virtual scope with a self scope_binding before membership writes, consistent with the ensure-virtual-scope ops.
- Backfill existing image membership rows into entity_memberships and verify ownership/permission queries return the same results pre/post migration.

JIRA Issue: BA-7259

Start by locating the image entity creation and rescan registration paths, the RBAC ops provider, and the ensure-virtual-scope operations. Trace the existing association_scopes_entities writes and related ownership or permission queries, then identify the backfill entry point. Done means new registrations use entity_memberships through the owning virtual scope, existing rows are migrated, and pre/post ownership and permission results match.

Written by the indexing model from the issue text.