The data copy preflight doesn't name extensions in other schemas or auth references outside functions and policies #175

Split from #173 (items 2 and 3), found in the review of #171.

The data copy preflight (spec S-007, docs/specs/007-data-copy-schemas.md) doesn't name two Supabase shapes, so the copy fails at pg_restore with ENGINE_STEP_FAILED and a raw restore error instead of a data_copy_preflight_refused finding. Both still fail safe: --single-transaction rolls the restore back.

1. An extension installed in an unselected schema. Supabase installs extensions in schema extensions. Copying --source-schema public dumps CREATE EXTENSION ... WITH SCHEMA extensions, which fails on a target without that schema. S-007 says nothing about it: the copy could refuse with a new finding, or create the extension in another schema
2. auth. references beyond functions and policies. A foreign key to auth.users, a column DEFAULT auth.uid(), and a view calling auth. aren't named under authReferences, which S-007 limits to functions and policies

Both change what S-007 specifies, so they need a spec change before any build.

Related: #82, #125, #173.