fix(db): preserve immutable artifact persistence (#145)

## Summary
- Fix generated media persistence by removing an unnecessary row lock on
immutable output metadata.
- Keep serialization at the existing per-user advisory transaction
boundary.
- Consolidate the pre-launch database history into one current-schema
baseline and one snapshot.
- Enforce that the agent role can insert/read generated outputs but
cannot update them.

## Decisions Made
| Decision | Choice | Reasoning |
|---|---|---|
| Concurrency boundary | Existing per-user advisory transaction lock |
It already serializes reservation and finalization; a second row lock on
immutable output rows was redundant. |
| Runtime permissions | Keep bounded INSERT/SELECT and no UPDATE |
Generated output metadata is immutable after publication. |
| Migration history | One clean baseline | This is a pre-launch
implementation and does not retain compatibility migrations. |

## How to Review
1. Review `packages/db/src/artifact-upload-intents.ts` for the
transaction change.
2. Review `scripts/supabase-target/index.ts` for the immutable ACL
assertion.
3. Verify `packages/db/drizzle` contains one SQL baseline, one snapshot,
and one journal entry.

## Test Plan
- [x] `pnpm --filter @cheatcode/db db:generate` (no schema changes)
- [x] `pnpm turbo typecheck`
- [x] `pnpm turbo lint`
- [x] `pnpm turbo build`
- [ ] Rebaseline the verified production Drizzle ledger and run
migration dry-run
- [ ] Deploy the agent Worker
- [ ] Generate images in production with natural-language and
explicit-action prompts

## Linear
No Linear issue was provided for this production fix.

## Plan
No repository plan document was required for this bounded fix.

Author: iamjr15

packages/db/README.md

@@ -53,7 +53,9 @@ mime, filename, and R2 object identity.
 - Assistant transcript segments are unique by run and segment, with one final
   segment marker.
 - Provider-key rows contain Vault references and non-secret fingerprints only.
-- Generated outputs and upload intents bind user, run, and project ownership.
+- Generated outputs are immutable after publication. Upload intents bind user,
+  run, and project ownership while the per-user project-mutation advisory lock
+  serializes reservation and finalization.
 - Agent-run skill-runtime capabilities store only bounded, short-lived digests;
   the agent role rotates them under signed user context and terminal transitions
   clear them.
@@ -106,25 +108,9 @@ External provider calls occur outside database transactions and advisory locks.
 
 ## Migrations
 
-The repository keeps a single current-schema Drizzle baseline at
-`drizzle/0000_current_schema.sql`, its generated snapshot, and the journal.
-Future schema changes append ordinary forward Drizzle migrations. The
-pre-launch historical migration archive is intentionally absent.
-
-The baseline's checksum was intentionally revised on 2026-07-31 to remove
-unrunnable `supabase_admin` default-ACL recreations (platform-managed state the
-`postgres` migration role is denied on every Supabase project). Databases that
-recorded the pre-revision baseline fail ledger verification with "Migration
-ledger diverges from source at position 0." The one-time remedy, run once as
-the migration admin against that database only:
-
-```sql
-update drizzle.__drizzle_migrations
-   set hash = '<sha256 of the current drizzle/0000_current_schema.sql>'
- where created_at = 1784981026716;
-```
-
-Compute the hash with `shasum -a 256 packages/db/drizzle/0000_current_schema.sql`.
+The repository keeps one current-schema Drizzle baseline at
+`drizzle/0000_current_schema.sql`, one generated snapshot, and one journal
+entry. The pre-launch migration history is intentionally absent.
 
 ```bash
 pnpm --filter @cheatcode/db db:generate
@@ -142,11 +128,10 @@ The migration runner:
 6. validates the complete current table, column, constraint, index, function,
    RLS, grant, role, and data-integrity contract.
 
-The target-parity migration also installs the required Supabase extensions and
-removes the `anon`, `authenticated`, and `service_role` access and default ACLs
-from `public`. This schema-USAGE revoke is deliberate because Cheatcode does
-not use the Supabase Data API. Supabase-managed Vault-schema grants remain
-untouched.
+The baseline installs the required Supabase extensions and removes the `anon`,
+`authenticated`, and `service_role` access and default ACLs from `public`. This
+schema-USAGE revoke is deliberate because Cheatcode does not use the Supabase
+Data API. Supabase-managed Vault-schema grants remain untouched.
 
 `pnpm dev:setup` supplies the role passwords and signed-context Vault rows that a
 schema migration cannot safely embed, then proves real logins and signed tenant