test(manager-core): schema snapshot guardrail

Boots a fresh Postgres via sqlx::test, applies every migration in
order, dumps the resulting public schema (tables, columns with type
+ nullability + default, indexes, constraints, applied migration
manifest), and compares against a checked-in golden text file.

What this catches:
  * Someone edits a committed migration — schema diverges from the
    snapshot, test fails with a precise diff.
  * Someone adds a migration but forgets to update the snapshot —
    same divergence; test reminds them.
  * Two migrations drift apart in any other way — snapshot is the
    source of truth about the post-replay schema.

Update workflow when adding a migration intentionally:

  BLESS=1 DATABASE_URL=postgres://... \
    cargo test -p picloud-manager-core --test schema_snapshot \
    -- --include-ignored

Review the snapshot diff in the same PR. The header comment makes
it clear the file is not for hand-editing.

  * Snapshot dump uses information_schema.columns + pg_indexes +
    pg_constraint with pg_get_constraintdef. Output is sorted on
    every dimension so cosmetic differences (insertion order,
    etc.) never cause spurious diffs.

  * #[ignore]'d by default for the same reason as the integration
    tests — needs DATABASE_URL pointing at a writable Postgres.

  * Initial expected_schema.txt blessed from the current
    migrations/ contents (3 tables, 9 indexes, 12 constraints).

Wires up enforcement item (4) from docs/versioning.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/manager-core/tests/expected_schema.txt

@@ -0,0 +1,80 @@
+# Schema snapshot — generated by schema_snapshot test.
+# Do not edit by hand. Run with BLESS=1 to regenerate.
+
+## tables
+
+table: execution_logs
+  id: uuid NOT NULL default=gen_random_uuid()
+  script_id: uuid NOT NULL
+  request_id: uuid NOT NULL
+  request_path: text NULL
+  request_headers: jsonb NOT NULL default='{}'::jsonb
+  request_body: jsonb NULL
+  response_code: integer NULL
+  response_body: jsonb NULL
+  logs: jsonb NOT NULL default='[]'::jsonb
+  duration_ms: integer NOT NULL default=0
+  status: text NOT NULL
+  created_at: timestamp with time zone NOT NULL default=now()
+
+table: routes
+  id: uuid NOT NULL default=gen_random_uuid()
+  script_id: uuid NOT NULL
+  host_kind: text NOT NULL
+  host: text NOT NULL default=''::text
+  host_param_name: text NULL
+  path_kind: text NOT NULL
+  path: text NOT NULL
+  method: text NULL
+  created_at: timestamp with time zone NOT NULL default=now()
+
+table: scripts
+  id: uuid NOT NULL default=gen_random_uuid()
+  name: text NOT NULL
+  description: text NULL
+  version: integer NOT NULL default=1
+  source: text NOT NULL
+  timeout_seconds: integer NOT NULL default=30
+  memory_limit_mb: integer NOT NULL default=256
+  created_at: timestamp with time zone NOT NULL default=now()
+  updated_at: timestamp with time zone NOT NULL default=now()
+  sandbox: jsonb NOT NULL default='{}'::jsonb
+
+## indexes
+
+indexes on execution_logs:
+  execution_logs_pkey: public.execution_logs USING btree (id)
+  execution_logs_script_id_created_at_idx: public.execution_logs USING btree (script_id, created_at DESC)
+
+indexes on routes:
+  routes_lookup_idx: public.routes USING btree (host_kind, host)
+  routes_pkey: public.routes USING btree (id)
+  routes_script_id_idx: public.routes USING btree (script_id)
+  routes_unique_binding_idx: public.routes USING btree (host_kind, host, path_kind, path, COALESCE(method, ''::text))
+
+indexes on scripts:
+  scripts_name_uidx: public.scripts USING btree (lower(name))
+  scripts_pkey: public.scripts USING btree (id)
+
+## constraints
+
+constraints on execution_logs:
+  [CHECK] execution_logs_status_check: CHECK ((status = ANY (ARRAY['success'::text, 'error'::text, 'timeout'::text, 'budget_exceeded'::text])))
+  [FOREIGN KEY] execution_logs_script_id_fkey: FOREIGN KEY (script_id) REFERENCES scripts(id) ON DELETE CASCADE
+  [PRIMARY KEY] execution_logs_pkey: PRIMARY KEY (id)
+
+constraints on routes:
+  [CHECK] routes_host_kind_check: CHECK ((host_kind = ANY (ARRAY['any'::text, 'strict'::text, 'wildcard'::text])))
+  [CHECK] routes_path_kind_check: CHECK ((path_kind = ANY (ARRAY['exact'::text, 'prefix'::text, 'param'::text])))
+  [FOREIGN KEY] routes_script_id_fkey: FOREIGN KEY (script_id) REFERENCES scripts(id) ON DELETE CASCADE
+  [PRIMARY KEY] routes_pkey: PRIMARY KEY (id)
+
+constraints on scripts:
+  [CHECK] scripts_memory_limit_mb_check: CHECK (((memory_limit_mb > 0) AND (memory_limit_mb <= 2048)))
+  [CHECK] scripts_timeout_seconds_check: CHECK (((timeout_seconds > 0) AND (timeout_seconds <= 300)))
+  [PRIMARY KEY] scripts_pkey: PRIMARY KEY (id)
+
+## applied migrations
+  0001: init
+  0002: sandbox
+  0003: routes