Harden migrations, secret handling, database CI, and releases

[ORESoftware]

What changed

Migration correctness

• Make dpm apply fail closed with exit code 3 whenever the post-apply catalog still differs from the source, including gated destructive and manual changes.
• Print the residual migration SQL and pass it to the optional discrepancy reviewer.
• Add live PostgreSQL and CockroachDB regressions proving a gated migration reports residual drift instead of returning success.
• Harden SQL scanning for PostgreSQL E'...' and U&'...' escape strings, doubled quoted identifiers, valid dollar-quote tags, nested comment-only tails, and UTF-8-safe diagnostics.
• Preserve the established DISAGREED contract when an external checker runs and exits nonzero; only process-launch failures are infrastructure errors.

Credential and temporary-file safety

• Redact database URL authority passwords and complete query strings from diagnostics.
• Shell-quote external-check {source} and {target} placeholders and redact their recorded commands and output.
• Remove Liquibase and Flyway passwords from process arguments; pass them through the tools' documented environment variables instead.
• Create AI review payloads with exclusive creation, Unix mode 0600, shell-quoted paths, and automatic cleanup.
• Create cross-check scratch directories with exclusive creation, Unix mode 0700, and automatic cleanup.
• Make shadow database names less collision-prone across concurrent processes.

CI and repository controls

• Run the live convergence suite on PostgreSQL 16 and PostgreSQL 17.
• Run the full CLI lifecycle on PostgreSQL 17.
• Run the CockroachDB suite on CockroachDB 25.2.4.
• Retain the seven-tool independent countersigning matrix: migra, pgdiff, Atlas, pg-schema-diff, Liquibase, apgdiff, and Flyway.
• Add least-privilege workflow permissions, concurrency cancellation, timeouts, locked Cargo resolution, clippy, and changed-file rustfmt enforcement.
• Pin GitHub Actions to reviewed commit SHAs and harden the Nix contract so checks do not mutate the lock file.
• Add a pinned RustSec audit, weekly Dependabot updates for Cargo and Actions, and a private vulnerability-reporting policy.

Release hardening

• Validate manual release tags from environment variables rather than interpolating untrusted input into shell source.
• Restrict default workflow permissions to read-only and grant write/OIDC/attestation permissions only to the jobs that need them.
• Pin release actions, disable persisted checkout credentials, and build with --locked.
• Resolve the tag once, record its immutable commit, and verify the tag still points to that commit before assets or a crate are published.
• Gate target builds on a successful cargo publish --dry-run --locked preflight.
• Serialize release workflows, create one draft release, upload all four target assets, and publish the release only after every target succeeds.
• Continue using crates.io trusted publishing with a short-lived OIDC token.

Primary audit finding fixed

Before this change, dpm apply could detect residual drift after executing a partially gated migration, print a warning, and still exit 0 unless an optional external cross-checker was enabled. Deployment automation could therefore treat a partial migration as successful despite the CLI's documented non-convergence exit code.

Validation

• cargo clippy --locked --all-targets -- -D warnings
• cargo test --locked --lib — 98 passed
• cargo test --locked --test fuzz_splitter — 7 passed
• changed-file rustfmt --check
• git diff --check
• isolated package/install contract
• live PostgreSQL 16 convergence suite
• live PostgreSQL 17 convergence suite
• live PostgreSQL 17 CLI lifecycle
• live CockroachDB 25.2.4 convergence and CLI suite
• seven-tool PostgreSQL cross-check matrix
• Nix flake and noninteractive agent contract
• RustSec dependency audit
• GitHub accepted the hardened release workflow as active; no real tag or public release was created by this PR

Scoped follow-ups

• Serialize concurrent apply operations across planning and convergence checks #16 — serialize concurrent apply operations across planning, execution, and convergence checks.
• Pin and verify every external tool and container used by CI #17 — pin and verify every external cross-check binary, archive, package, and container image.
• Format the repository baseline and restore a repository-wide rustfmt gate #18 — format the existing repository baseline, then restore a repository-wide rustfmt gate.
• Define backend-specific migration atomicity, partial-failure recovery, and Cockroach retries #19 — define backend-specific atomicity, partial-failure recovery, and CockroachDB retry semantics.

The GitHub App could not read branch or tag protection settings, so this PR does not claim those repository controls are enabled. This PR deliberately does not merge the larger concurrency, transactional-recovery, or full external-tool supply-chain changes into the convergence fix.

[linear-code]

DEN-1960