fix(core): prevent tag leakage by trusting resolved empty deps in LaunchQLMigrate.deploy

[pyramation]

fix(core): prevent tag leakage by trusting resolved empty deps in LaunchQLMigrate.deploy

Summary

Fixes a critical bug where tag references leak into database deployment procedures when resolved dependencies are empty arrays. The issue occurred in LaunchQLMigrate.deploy where the fallback logic would incorrectly use raw plan dependencies (which may contain unresolved tags like package:@tag) instead of trusting the empty array returned by the dependency resolver.

Key Change: Modified the fallback condition from (resolvedFromDeps && resolvedFromDeps.length > 0) to (resolvedFromDeps !== undefined) to trust empty dependency arrays from the resolver.

Review & Testing Checklist for Human

• Critical: Test the original failing CLI command (lql deploy --recursive --database ${testDb.name} --yes --no-usePlan --package unique-names) to verify it now passes
• Critical: Review the core logic change in packages/core/src/migrate/client.ts:178 - confirm that trusting empty arrays over plan dependencies is the correct behavior
• Important: Run the existing migration test suite to ensure no regressions in deployment behavior
• Important: Verify the reproduction test actually represents the real-world scenario (it uses extensive mocking)

Notes

• The reproduction test in packages/core/__tests__/migrate/tag-fallback.test.ts demonstrates the bug and verifies the fix
• This change affects core deployment logic, so thorough testing is essential
• The diff includes additional refactoring and fixture updates that should be reviewed for scope appropriateness

Link to Devin run: https://app.devin.ai/sessions/1f918a5be7bd48fbb9f3967912399928
Requested by: Dan Lynch (@pyramation)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring