Cloud SQL's postgres (cloudsqlsuperuser) cannot CREATE OR REPLACE a
function owned by another role. Drop both overloads first so a plain
CREATE works regardless of prior ownership state.
Also removes the dynamic ACL normalization block — a freshly created
function has no stale ACLs to scan and revoke.
Cloud SQL's postgres role is cloudsqlsuperuser, not a true superuser.
After ALTER FUNCTION ... OWNER TO leoclean_kb_stage_owner, it can no
longer revoke ACLs on the transferred function:
ERROR: permission denied for function stage_leoclean_proposal
Reorder so ACL normalization and the runtime GRANT happen while postgres
still owns the function, then transfer ownership. Identical end state.
Observed on teleo-pgvector-standby during M2 Step 4 provisioning
(BOOTSTRAP_EXIT=3 at SQL line 800).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
