feat(db): align migration prototype with single-table RFC

[Zxf-xufeng]

Which issue or RFC does this PR close?

Refs #1756 and implements the acceptance phase of RFC #1771. The implementation branch contains no RFC documents. #1716 remains independent; this PR does not close the remaining production rollout requirements.

Rationale for this change

Explicit database maintenance needs a trustworthy schema version and recoverable execution without adding run, step, or task control tables. Installing software remains separate from changing database structure. A successful four-table migration must not be mistaken for complete Server readiness.

What changes are included in this PR?

• Use Alembic's single pc_schema_revision(version_num) control table. Keep durable maintenance intent, resource checksums, backup references, and recovery progress outside the business database.
• Package frozen historical schemas and a linear p0001–p0003 chain covering four Artifact tables. Execute immutable resource snapshots and validate the actual schema and stored data before advancing the version. SQLite retains the replaced Tag table; seekdb/OceanBase change its CHECK constraint in place.
• Provide server db-migrate status/plan/apply/verify for persistent SQLite, embedded seekdb, and OceanBase MySQL-mode databases through the configured maintenance adapter. These connections do not initialize current application metadata or open a business Repository. Plans bind target identity, schema, resources, configuration, backup policy, and maintenance scope.
• Handle nontransactional seekdb/OceanBase DDL through exact registered transition prefixes and persistent external evidence. Interrupted adoption, committed partial DDL, and a committed version whose journal update was interrupted can resume. Unknown layouts or missing/inconsistent recovery evidence stop execution. Retries preserve the original backup decision and recovery point.
• Hold the embedded seekdb directory lock through engine shutdown, including cross-process exclusion through canonical path aliases. Reject runtime fallback from native OS locking to soft locks. OceanBase uses a stable cluster/tenant/database identity with an explicit single-host OS coordinator lock and durable external run receipt. All four OceanBase commands require --lock-coordination single-host and one persistent --evidence-dir on the fixed maintenance host. Business Servers may remain distributed.
• Support configured OceanBase connections through ODP without GET_LOCK(), fixed physical session IDs, or PROCESS privileges. Normal completion and successful connection closure clear the run receipt. An interrupted run blocks verification and ready/no-op shortcuts, even if its Alembic head is current. After a DBA confirms that prior remote execution and background DDL have ended, recovery requires an exact --acknowledge-previous-run token bound to the reviewed plan and rechecked under the lock. PC does not automatically establish remote quiescence; acknowledgement never bypasses schema, data, resource, backup, or original-journal checks.
• Provide native BackupProvider implementations, unchecked manual-backup declarations, and explicit no-backup consent. SQLite Online Backup includes committed WAL. Native Fork feature detection remains separate from accepted restoration workflows; unavailable automatic backup never silently falls back. The current executor also rejects automatic table Fork before writes because same-database backup-object tracking is not yet registered.
• Add service stop/start/restart and a separately tested maintenance controller. Stopped services retain registration with native activation suppressed. Startup validates the loaded definition, active manager state, and readiness; interruptions and cleanup errors preserve the failure and stopped-state evidence. Complete service switching remains disabled for this partial database bundle.
• Update bilingual website migration guidance and extend the existing Python 3.11/3.14 seekdb CI job with unified runner, schema, connection, data-integrity, and interruption-recovery coverage. Preserve the incorporated fix(persistence): finish connection cleanup before a cancellation propagates #1782 SQLite transaction/cancellation fixes and their authorship.

Are there any user-facing changes?

This is Phase A acceptance. The installed bundle covers only pc_artifacts, pc_artifact_heads, pc_artifact_candidate_versions, and pc_artifact_tags. Output reports readiness_scope=registered_bundle and server_ready=false. Complete Server databases with unmanaged objects are rejected. Normal application startup and processing-migrate remain outside this bundle, and --manage-service cannot switch a business service.

All three backends now have deployment executors for registered layouts. Existing seekdb/OceanBase databases can use declared manual backup or explicitly accepted no-backup risk. Automatic Fork backup remains unavailable until release-owned recovery acceptance exists; a version number alone does not enable it. The engine feature minima are OceanBase AI Database 4.6.2 for both Fork forms, seekdb 1.1.0 for table Fork, and seekdb 1.2.0 for database Fork. Empty initialization requires no backup.

OceanBase requires access to tenant and cluster identity metadata, one fixed maintenance host, and an explicit persistent evidence directory. Minimal isolated four-table acceptance passed through an existing ODP endpoint on OceanBase AI Database 4.6.3. Normal upgrades retain one confirmation; an interrupted OceanBase run additionally requires the explicit DBA declaration described above. Complete historical baselines, legacy-task/data/projection validators, startup/SDK/Worker gates, full index coverage, and mandatory schema-change checks remain production prerequisites. No existing business database or personal service was modified during this work.

How was this change tested?

• UV_NO_SYNC=1 UV_OFFLINE=1 PREK_NO_CONCURRENCY=1 make check: lock consistency, workflow/reference checks, pre-commit hooks, full type checks, and 33 integration-manifest tests passed.
• Current migration, backup, connection, schema, CLI, coordinator-lock, and probe regressions on Python 3.14.6: 147 passed, 30 skipped. Service-maintenance regression: 39 passed. Optional native environments remain opt-in; these skips are not backend acceptance.
• Real isolated embedded seekdb 1.4 (pylibseekdb 1.4.0.post1): 20 passed, including all 10 runner cases, schema reflection/data integrity, dedicated connections, and real cross-process exclusion through a symlink alias. The selection skips the OceanBase-only interrupted-run acknowledgement case.
• Real OceanBase AI Database 4.6.3 through ODP: one disposable database with four historical Artifact tables and three sample rows. Verified coordinator exclusion across commits; unavailable automatic backup without schema changes; recovery after the first ALTER had committed, with unacknowledged retry rejected and explicit matching acknowledgement accepted; preserved data and exactly one added version table; final verification and no-op; and completed-head refusal while an unresolved run receipt remains. Wrong-token recovery was rejected and matching-token verification required no new backup. The test database was removed and its absence independently confirmed after the DROP response timed out. No existing business database or proxy/tenant setting was changed. This is not full Server, automatic remote-DDL completion detection, or Fork restoration acceptance.
• Independent real seekdb checkpoint review also verified recovery after the p0003 CHECK removal committed before its version update.
• Wheel build passed; the three new backend modules and all four MySQL Alembic resource files are packaged. Frozen released resources were not changed.
• Both updated documentation pages compile as MDX. Full website lint/build was not rerun successfully because the worktree's missing dependencies require unavailable registry access. git diff --check passed.

AI usage statement

Implemented, independently reviewed, and tested with OpenAI Codex. Incorporated #1782 fixes preserve their original authors and Claude co-author attribution. Backend evidence distinguishes real execution from uncompleted production acceptance.