v2 ops: govern scope entities, own resource entities, relate entities with read grants

The v2 ops write one relation per hook. `RoleManagedEntityCreator.governed_by(row)` names the scope whose roles hold authority over the new entity and everything it owns; it writes a `scope_bindings` row only. `EntityCreator.owned_by(row)` / `EntityUpserter.owned_by(row)` name the virtual entities that own the new entity; they write `entity_memberships` edges only (capped = false). Today `member_of` writes both rows for every parent, leaving a redundant edge (domain <- project) and a redundant binding (session -> project) on each creation.

A relation between two entities (project and resource group) is two READ-capped grants, one per direction, next to the relation row: `create_relation(creator, left, right)` consumes BEP-1075's `RelationCreator` and writes the row plus the two grants; `purge_relation` removes both.

Scope: v2 ops, specs, creators, tests, `models/specs/AGENTS.md`, BEP-1077 5.1. Legacy `RBACWriteOps` and its callers stay as they are; no data migration (the redundant rows change no resolution result and are removed with the legacy writers).

JIRA Issue: BA-7634

Start with the v2 ops creators named in the issue—RoleManagedEntityCreator.governed_by, EntityCreator.owned_by, EntityUpserter.owned_by, create_relation, and purge_relation—then read the v2 ops specs and tests plus models/specs/AGENTS.md and BEP-1077 5.1. Done means governed entities write only scope_bindings, owned entities write only uncapped entity_memberships, relations manage their row and two READ-capped grants, and legacy RBACWriteOps remains unchanged.

Written by the indexing model from the issue text.