Clean up rc-era assignment membership rows and verify permission cap behavior

Add an idempotent alembic migration removing the membership/association rows that 26.8 rc deployments created for idle_checker_assignment entities. Add tests proving the permission_cap semantics on the new checker memberships: effective = role permission AND cap, so a role holding UPDATE|SOFT_DELETE reaches only UPDATE through the connection.

## Success Criteria
- [ ] migration removes stale idle_checker_assignment membership rows; re-run adds/removes nothing
- [ ] cap test: UPDATE|SOFT_DELETE role resolves to UPDATE-only effective permission via the connection
- [ ] pants test passes for affected packages

JIRA Issue: BA-7278

Locate the Alembic migrations and membership tests for idle_checker_assignment entities, then inspect the affected packages before changing anything. Run the relevant Pants tests first. Done means the migration is idempotent, stale rows are removed, the connection resolves UPDATE|SOFT_DELETE capped to UPDATE, and the affected Pants tests pass.

Written by the indexing model from the issue text.