storage(schema): enforce enrollment event reference shape

[TusanHomichi]

Migration 0006 permits a withdrawal, completion, or reinstatement with exactly one program-version reference. Migration 0014 makes the full shape a database-enforced rule: version changes name both versions, and other kinds name neither.

• Add a BEFORE INSERT shape trigger, retaining the existing unconditional no-update trigger, CHECK constraints, indexes, and incoming phase-event references.
• Validate existing rows before installing enforcement. Malformed legacy history fails the named enrollment_event_legacy_version_references_invalid constraint; startup stops, and the migration transaction leaves history, schema, and ledger unchanged. No guessed correction or deletion occurs.
• Use a trigger plus upgrade validation instead of the issue's proposed table rebuild. This preserves the append-only table and its incoming references while keeping SQLx's transactional migration runner and foreign-key enforcement unchanged. ADR 0018 records the choice.
• Add direct schema and upgrade tests: all event/reference combinations; all six legacy loopholes; repeated-failure rollback and startup refusal; valid history/epoch/schema preservation; byte-identical fixed-instant packets; foreign-key/integrity checks; and retained write restrictions.

Validated locally at b9c50da0f735ad447fe3a175005bf5000861db90: npm ci, npm run check, npm run build, cargo fmt --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test --workspace (134 passed), cargo build -p consolebook-server, npx playwright install chromium, and npm run e2e -- --workers=2 --trace retain-on-failure (8 passed). Heavy suites ran sequentially; browser concurrency was limited to two workers on the shared development machine. The web install still reports the three existing low-severity npm audit entries tracked in #54.

No packet-format, service API, historical migration checksum, or preview deployment changes. Valid upgrades scan the event history without rewriting its table; malformed legacy history requires a separately authorized repair decision.

Closes #51.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T00:50:27.499596Z	b9c50da	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.