feat(db): automate production migrations

[caio-pizzol]

Summary

• record each applied migration filename and SHA-256 checksum in schema_migrations
• apply pending migrations atomically under a PostgreSQL advisory lock
• stop automated deploys when migration history is missing, empty, or changed
• serialize the full production migration and deploy workflow
• run focused migration-runner tests in CI

Why

Production was current, but migrations were applied manually and deploys did not verify the database first. This makes migration state visible, protects applied files from edits, and deploys the web app and MCP Worker only after the database is ready.

The runner does not guess how to initialize an untracked database. Fresh or older databases must be verified and explicitly baselined before automated deploys can use them.

Testing

• bun test tests/scripts/db-migrate.test.ts (5 passing)
• bun run typecheck
• bun run lint (passes with the existing unrelated warning in scripts/ingest-xsd/ingest.ts:34)
• bun run build
• pre-commit and pre-push hooks
• CI and Cubic review on the final PR head

Production validation

• configured the existing Neon DATABASE_URL as a GitHub Actions repository secret
• recorded migrations 0001 through 0007 in production with matching checksums
• ran the migration command again and confirmed the database is up to date

[cubic-dev-ai]

All reported issues were addressed across 7 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 5 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>