refactor(store): fold migrations 0002..0008 into 0001_init (RIG-4556)

[rigel-mintaka]

Summary

Folds migrations 0002..0008 into 0001_init.sql for the dogfood reset (RIG-4556). The mattfw dev database is wiped, so migration history is dead weight again.

Change

• 0001_init.sql now creates everything the folded files added:
  • tokens.tenant_id
  • session_bindings.usage_interval_id
  • issues.search_tsv and compass_labels_text
  • linear_agent_sessions.linear_issue_identifier
  • the token-usage tables and the compute-usage log
  • account_tour_state
• Their grants, revokes, RLS policies and updated_at triggers move into the existing 0001 blocks.
• Deleted the 0002..0008 files and the pgtests that replayed them over a v1 database: backfill_empty_tenant, token_tenant_migration, migrate_upgrade.
• applyV1Only and execAsSystem move to the remaining tests that use them.
• server_secrets_pgtest now also pins the compute log's withheld UPDATE and DELETE.

pg_dump schema diff

The test applies main's 0001..0008 chain to one database and the folded 0001 to another, then runs pg_dump --schema-only --no-owner on each.

chain files: 0001_init.sql 0002_backfill_empty_tenant.sql 0003_token_usage.sql 0004_token_tenant.sql 0005_issues_search.sql 0006_compute_usage.sql 0007_account_tour_state.sql 0008_linear_issue_identifier.sql
folded files: 0001_init.sql
--- schema diff (0 bytes) ---
sha256 chain.sql  = folded.sql = 725d7922e85274791274df50ee38198d2746e61c847ebca6f3609428042ee2e9

The data dump differs only in the now() timestamps of the seeded token_usage_prune_horizon row.

The check can fail. Moving tokens.tenant_id before revoked_at produces a non-empty diff.

Gate

migration-immutability rejects this PR by design, so rollup stays red. Matt ruled option C on RIG-4572: this PR needs Matt's admin-bypass merge of the red rollup. Every other check must be green.

After merge

• Wipe the mattfw dev database with compass-recreate. The wipe follows the merge, never precedes it.
• Any local devenv compass database that ran the old chain fails on open with a v1 checksum mismatch. Drop and recreate it.
• The open PRs adding 0009 (feat(usage): derive compute-usage rollups and prune the raw compute log (RIG-2872) #1513, feat(auth): mint and verify per-agent gateway tokens (RIG-2864) #1752, feat(comms): carry the agent turn sequence to the stored message and the settle sink (RIG-4323) #1602, feat(server): add forge scope storage (RIG-4434) #1654, feat(store): unique sibling channel-group names with a repairing migration (RIG-3030) #1595, feat(store): attach channels to agents with tree or explicit membership (RIG-4186) #1762) would leave a gap that checkContiguous rejects. Each renumbers to 0002, one at a time.

[trunk-io]

😎 This pull request was merged.

[linear-code]

RIG-4556

[github-actions]

Compass engineering docs preview: https://compass-agent-rig-4556-colla.compass-eng-docs.pages.dev

Deployed from compass-agent/rig-4556-collapse-migrations at f0c4898.

Changed pages:

• docs/designs/server/compass-linear-return-path-indirection-amendment/design.md