feat(pgpm-core): applyEnvelope — apply a bundle envelope (schema + data/fixtures replay) into a target DB

[pyramation]

Summary

The generic applyMigrationBundle primitive (fn #4, constructive-planning#1246): applies a BundleEnvelope (#1435) into a target database. New pgpm/core/src/bundle/apply-envelope.ts, additive — lives in core because it drives PgpmMigrate via the existing applyBundle (same reason applyBundle isn't in @pgpmjs/bundle).

previewEnvelopeApply(envelope, { validateReferences? }): EnvelopeApplyPreview
// pure: verifyEnvelope tamper gate + previewBundleApply(schema) + partOrder +
// layered rollbackPlan { parts: reverse replay order w/ hasRevert flags, schema: [...] }

applyEnvelope(envelope, {
  config, dryRun?, verify?, verifyParts?,
  transformPartSql?: (sql, {kind, name, script}) => sql,   // ID-remap seam, identity by default
  timeoutMs?, allowUnverified?, validateReferences?, migrateOptions?
}): EnvelopeApplyResult
// { preview, dryRun, executed, schema?: ApplyBundleResult,
//   parts: {kind, name, executed, verified?, durationMs}[], durationMs, timedOut }

Semantics:

• Pre-flight gate: refuses on any verifyEnvelope issue (unless allowUnverified); the schema half's integrity/namespace gates are then enforced again by applyBundle. EnvelopeApplyError carries the preview + parts completed so far (status/rollback metadata for a later supervised compute-worker wrapper).
• Dry-run returns the full preview without touching the DB.
• Schema applies via the existing applyBundle (atomic tx, timeout) — nothing re-implemented.
• Parts (data then fixtures, manifest order) replay their deploy SQL inside one transaction on the shared getPgPool plumbing: a failing part rolls back all part data, the schema stays applied, and the error points at preview.rollbackPlan. Optional per-part verify script execution (verifyParts).
• Deterministic ID remap (chore: update schemas from constructive-db #1225 §2.5) is deliberately NOT built — the transformPartSql seam runs on part SQL just before execution and never sees schema-bundle SQL.

Validated: 8 new tests (pure preview, dry-run, envelope/schema tamper refusal, full DB-backed apply with part verify, part-failure rollback semantics, transform seam), core 363/363, build green. Skill doc updated with the apply surface.

Link to Devin session: https://app.devin.ai/sessions/ad40d16f38a349b48eb7ce9375e27e6e
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring