fix: finish V1 production cleanup (#46)

## Summary
- Restore the V2 thread model update grants removed by the runtime
privilege rebuild.
- Remove the final two V1 pgvector search functions from production.
- Let migration-only commits pass the staged Biome hook without
bypassing hooks.

## Decisions
- Keep the already-applied 0078 migration immutable and add 0079 for the
actual `extensions.vector` type identity.
- Grant only the V2 column permissions required by the gateway and agent
roles.

## Verification
- [x] Guarded production migrations applied in their declared phases.
- [x] Production readiness validation passes.
- [x] Legacy tables, functions, and cron jobs report zero.
- [x] V2 user, projects, threads, and runtime grants remain intact.
- [x] Lint, typecheck, production build, and live gateway health pass.

Author: iamjr15

infra/supabase/migrations/post/0077_restore_thread_model_runtime_grants.sql

@@ -0,0 +1,4 @@
+-- 0069 rebuilds the runtime privilege surface after earlier expansions. Model
+-- attribution arrived later, so restore only the two V2 update grants its
+-- writers require after that rebuild.
+grant update (latest_model_id) on table public.v2_threads to app_gateway, app_agent;

infra/supabase/migrations/post/0078_remove_v1_vector_search_functions.sql

@@ -0,0 +1,14 @@
+-- The protected V1 cleanup resolved visible vector arguments as `vector`, not
+-- `public.vector`, and therefore left these two exact legacy functions behind.
+-- Drop only the audited V1 signatures; RESTRICT preserves the cleanup boundary.
+drop function if exists public.match_components(
+  public.vector,
+  double precision,
+  integer
+) restrict;
+
+drop function if exists public.match_mobile_components(
+  public.vector,
+  double precision,
+  integer
+) restrict;

infra/supabase/migrations/post/0079_remove_extensions_vector_v1_functions.sql

@@ -0,0 +1,13 @@
+-- Production installs pgvector in `extensions`, so remove the two remaining
+-- V1 search functions against their actual argument type identities.
+drop function if exists public.match_components(
+  extensions.vector,
+  double precision,
+  integer
+) restrict;
+
+drop function if exists public.match_mobile_components(
+  extensions.vector,
+  double precision,
+  integer
+) restrict;

infra/supabase/migrations/raw-phases.json

@@ -62,5 +62,8 @@
   "infra/supabase/migrations/post/0073_finalize_direct_run_statuses.sql": "post-deploy",
   "infra/supabase/migrations/post/0074_remove_product_policy_residue.sql": "post-deploy",
   "infra/supabase/migrations/post/0075_attribute_thread_models.sql": "pre-deploy",
-  "infra/supabase/migrations/post/0076_remove_skill_proposals.sql": "pre-deploy"
+  "infra/supabase/migrations/post/0076_remove_skill_proposals.sql": "pre-deploy",
+  "infra/supabase/migrations/post/0077_restore_thread_model_runtime_grants.sql": "pre-deploy",
+  "infra/supabase/migrations/post/0078_remove_v1_vector_search_functions.sql": "post-deploy",
+  "infra/supabase/migrations/post/0079_remove_extensions_vector_v1_functions.sql": "post-deploy"
 }

lefthook.yml

@@ -3,7 +3,7 @@ pre-commit:
   commands:
     biome-staged:
       glob: "*.{ts,tsx,js,jsx,json,jsonc}"
-      run: pnpm biome check --staged --write {staged_files}
+      run: pnpm biome check --staged --write --no-errors-on-unmatched {staged_files}
       stage_fixed: true
 
 commit-msg:

pnpm-lock.yaml

@@ -47,7 +47,7 @@ overrides:
   'ajv@>=8.0.0 <8.18.0': 8.20.0
   'dompurify@<=3.4.10': 3.4.11
   'js-yaml@<3.15.0': 3.15.0
-  'js-yaml@>=4.0.0 <4.2.0': 4.2.0
+  'js-yaml@>=4.0.0 <4.3.0': 4.3.0
   'minimatch@>=10.0.0 <10.2.3': 10.2.5
   'path-to-regexp@>=6.0.0 <6.3.0': 6.3.0
   'path-to-regexp@>=8.0.0 <8.4.0': 8.4.2