fix(db): complete artifact intent insert acl - #148

Summary

• add the missing column-level INSERT grant for v2_artifact_upload_intents.quiesced_at to the single clean baseline
• assert that exact grant in production schema validation
• assert that the agent role still has no table-wide update access

Why

Drizzle emits the nullable quiesced_at column as DEFAULT when reserving an artifact upload. PostgreSQL therefore requires column-level insert permission even though application code omits the field. Production logs showed this exact permission failure after the preceding ownership-query corrections.

Production application

The grant and the one-row Drizzle baseline checksum were updated atomically under the database maintenance advisory lock. The production ledger still contains exactly one migration row.

Verification

• production contract dry-run passes
• production app_agent can insert quiesced_at
• production app_agent still cannot update the table broadly
• pnpm typecheck:scripts
• pnpm turbo lint
• pnpm --filter @cheatcode/db db:generate reports no schema changes