Good checklist. One item I'd add is views. A view in the public schema runs with its owner's rights by default, so it can quietly bypass the RLS on the tables underneath it. Creating it with security_invoker = true (Postgres 15+) makes it respect the caller's policies, and it's easy to miss because every table policy still looks correct.