[TheGreatAxios]

Summary

• DDL lives in migrations/0001_agent_token.sql (drizzle breakpoint format) and ships in the tarball.
• runAgentTokenMigrations(dbConfig, { schema }) replaces applyAgentTokenMigrations(databaseUrl, { tenantSchema }). schema is the host schema holding Interchange's tenant table (the value passed to runMigrations); tables stay in agent_token with the FK rewritten to <schema>.tenant. An empty schema or missing SQL throws, as in Interchange.
• Migrations run in one advisory-locked transaction.
• No runtime DBConfig validation: @intx/db 0.4.0 exports DBConfig as a type only.
• Breaking for workbench apps/hub/src/migrate.ts, which calls applyAgentTokenMigrations.
• Stacked on refactor!: export only the public API from the package root #7.

Verification

• bun install --frozen-lockfile, bun run typecheck, bun run build: pass
• DB suite against local Postgres (DATABASE_URL=... bun test --timeout 60000 ./src): 7 pass, 0 fail
• npm pack --dry-run lists the SQL; the built dist/migrations.js migrates under plain Node.

Closes CL-9218

[TheGreatAxios]

Self-review: diff matches the linked ticket(s); independent review passes addressed (fixed or waived as noted in the description); typecheck, build and the Postgres-backed suite pass on this branch.