Revoke the reader's grants as their own grantors and read them back, alter its role only on drift, and report definer functions and views (review of hq issue 337)

A superuser's REVOKE acts as the table owner, so a grant to the reader made
by a role holding GRANT OPTION survived it while the report said revoked.
Each grant is now revoked under SET ROLE to its grantor, the grants are read
back, and anything still held is reported as a failure. The role was
altered every minute with its password in the statement, which a server
logging DDL would record and which could collide with a first query; it is
now altered only when an attribute, a setting or the password has drifted,
one ensure at a time. SECURITY DEFINER functions and views the reader may
use reach data without a grant on it, so every pass lists them. The README
says the name filter is a backstop and that the read-only session default
can be turned off by a statement.

modules/postgres/cmd/postgres-provider/tools.go

@@ -73,7 +73,8 @@ func Tools(pg *Client) []stdio.Tool {
 			Description: "What the store's reader — the login every query runs as — may read in each database, as the last " +
 				"pass made it: the columns each module declares readable, what was refused because its name says it holds a " +
 				"secret, what was declared but is missing, what was revoked, and any secret column it can still read " +
-				"(exposed; queries there are then refused). Names only, never values. (r)",
+				"(exposed; queries there are then refused), and the SECURITY DEFINER functions and views it may use, which read " +
+				"with their owner's rights and which no grant shows. Names only, never values. (r)",
 			Run: func(map[string]any) (any, error) { return pg.LastReaderReport(), nil },
 		},
 		{