Move role-managed entity creation off the entity write ops

V2EntityWriteOps._create_preset_roles provisions the preset roles and writes their permission rows inline, so the entity write path knows the permission schema. The v2 permission ops (BA-7560) expose set / widen / revoke, but reaching them from inside the entity write ops would mean an entity write constructing permission ops.

Scope:
- Move the role-managed creation path (preset roles and the permissions they carry) out of V2EntityWriteOps into ops of its own, composing the entity ops and the permission ops.
- The role-managed path calls set_permissions instead of building PermissionRow.
- V2EntityWriteOps keeps the plain entity paths and stops importing PermissionRow.

JIRA Issue: BA-7581

Start by reading V2EntityWriteOps._create_preset_roles and the v2 permission ops introduced for BA-7560. Trace how preset roles and PermissionRow records are currently created, then identify the separate ops composition boundary. Done means role-managed creation uses set_permissions, while plain entity paths remain in V2EntityWriteOps without importing PermissionRow.

Written by the indexing model from the issue text.