Apply the virtual scope chain to the deployment entity

Settle every scope operation of the `deployment` entity on the virtual scope chain. The wiring declares 9 scope operations for it; each one is accounted for below. Resolve ownership through `entity_memberships` joined to `virtual_scopes`; helpers live in `src/ai/backend/manager/models/virtual_scope/queries.py`.

## Convert

- `list_model_service` and `search_services` — `EndpointRow.session_owner == :session_owner_id` (`repositories/model_serving/repository.py:214`, `:868`); extract into an OperationScope beside `ProjectDeploymentOperationScope`

## Already settled

- `search_deployments_in_project` — carried by BA-7529
- `create_deployment`, `create_legacy_deployment` — the create path records the project and the session owner

## Out of scope

- `search_deployment_scoped_history`, `scoped_search_replica_group_history` — parent-keyed history reads
- `dry_run_model_service`, `validate_model_service` — bound no stored rows

## Write side

Present. `models/endpoint/creators.py:79` declares `member_of() -> (project_id, session_owner_id)`, so the owner edge is already written.

## Done when

- No deployment read filters on a legacy ownership column.
- Each converted read has a test proving it returns the same rows as the column-based query on backfilled data.

JIRA Issue: BA-7549

Start with the virtual-scope helpers in src/ai/backend/manager/models/virtual_scope/queries.py and the list_model_service and search_services paths in repositories/model_serving/repository.py at lines 214 and 868. Compare their current ownership filtering with ProjectDeploymentOperationScope, then add tests showing both converted reads return the same rows as the column-based queries on backfilled data.

Written by the indexing model from the issue text.