Pin search_path on submit_draft_pick and undo_last_pick

[diese-tech]

Problem

Both live draft SECURITY DEFINER functions are unpinned in production. Verified directly:

SELECT p.oid::regprocedure, p.prosecdef, p.proconfig FROM pg_proc p
JOIN pg_namespace n ON n.oid = p.pronamespace
WHERE n.nspname='public' AND p.proname IN ('submit_draft_pick','undo_last_pick');
-- submit_draft_pick(text,text,text,integer,integer) — proconfig: null
-- undo_last_pick(text) — proconfig: null

The repo already has CI enforcement for exactly this on new functions (scripts/check-security-definer.sh, added in #146/#163) and supabase/tests/002_security_contract.test.sql checks pinning — these two functions predate the baseline and were never brought into compliance.

Fix

A forward migration: ALTER FUNCTION public.submit_draft_pick(...) SET search_path = pg_catalog, public; and the same for undo_last_pick, matching the house convention used elsewhere in the schema. Needs a release per docs/runbooks/deploy.md — not urgent, not draft-blocking, but should not be forgotten.

Found while investigating sal-site's draft-timer P0 during pre-draft-day review.