RBAC virtual scope adoption: storage spec lineage, identifiers, backfill, lifecycle

Follow-up epic to Virtual Scope (BA-6567). Makes virtual-scope membership the default effect of entity creation across all domains, so permission checks resolve through user - role - scope permission - virtual scope - entity.

Holds the v2 storage spec lineage foundation, UUID identifier unification for name-keyed entities, the membership backfill for rows created before the new lineage, the lifecycle reconciler for entities that outlive their scope, and the eventual read-path cutover from association_scopes_entities to the virtual scope chain.

JIRA Issue: BA-7285

Start by reading the Virtual Scope work referenced as BA-6567, then review the v2 storage spec lineage and the current association_scopes_entities read path. The work is done only when identifier unification, membership backfill, lifecycle reconciliation, and the eventual virtual-scope read-path cutover are all addressed across the listed domains.

Written by the indexing model from the issue text.