-- Lock search_path on enforce_session_immutable_columns() to mute the
-- Supabase advisor (function_search_path_mutable, lint 0011). Without
-- this, a malicious caller who can set search_path on their session
-- could in theory shadow the table reference inside the trigger body —
-- not actually exploitable here (the trigger only references NEW/OLD)
-- but the linter cannot prove that.
ALTER FUNCTION public.enforce_session_immutable_columns()
  SET search_path = public, pg_temp;
