feat(migrations)!: ship SQL migrations applied like runMigrations

[TheGreatAxios]

Summary

• runArtifactMigrations(config, { schema }) takes the same arguments as @intx/db's runMigrations. schema is the host schema that holds tenant and principal. The package's tables stay in artifacts, and the "public". FK references are rewritten to schema.
• The DDL now ships as idempotent SQL files under migrations/, included in files. 0001_artifacts.sql creates the final 0.1.0 shape. 0002_drop_migration_ledger.sql drops the old artifacts.migrations ledger.
• The embedded TypeScript DDL, the checksum ledger, adopt, RunArtifactMigrationsOptions, MigrationChecksumError and MigrationAdoptError are removed. The run is still one transaction behind the same advisory lock key, so old and new replicas serialize during a rolling deploy.
• migrations.test.ts is cut to the runner contract: exact table set, re-run no-op, concurrent cold boots, FKs aimed at the host schema, the constraints, and the pre-0.1.0 column upgrade.
• README, CONTRIBUTING, CHANGELOG and the reference host use the new signature.
• A database from before 0.1.0 that never booted on 0.1.0 is brought to 0.1.0's shape by 0001: metadata, content_sha256 and parent_version_ids are added with ADD COLUMN IF NOT EXISTS, and any column in artifacts still typed timestamp becomes timestamptz (read as UTC, as 0.1.0 did). A current database is untouched.
• Stacked on refactor!: stop exporting the drizzle tables from the package entry #26.

Verification

• typecheck clean. 324 package tests and 42 reference-host acceptance tests pass against Postgres 16.
• The packed tarball includes migrations/*.sql, and runArtifactMigrations runs from a plain Node 24 consumer.
• Upgrade check: a database migrated by the runner on main, with a row in it, re-migrates cleanly. The ledger is dropped, the four tables remain and the row is kept.

Closes CL-9060
Closes CL-9062

[TheGreatAxios]

Reviewed the commit. 0001's shape matches old migrations 0001-0005: timestamptz columns, NOT NULL tenant_id, the four CHECKs, metadata and digest columns. The FK rewrite regex is the same one Interchange's rewriteSchemaQualifiedReferences uses. The lock key is unchanged, the package tarball ships migrations/, and the upgrade path was exercised against a database migrated on main. No blocking findings.

[TheGreatAxios]

Follow-up pushed: the reference host exposes its config so the acceptance test no longer parses the URL itself, and the runner passes ssl only when DBConfig sets it. A second review found three low or informational points: a similar URL helper in src/test-helpers.ts (#29 removes the example's separate package), test parsers ignoring sslmode, and no runtime validation of the typed DBConfig. Greybeard waived all three. I also diffed a database migrated by the main-branch runner against one migrated by this runner: columns, types, nullability, defaults, constraints and indexes are identical.