fix(vendor): vendor the upstream db migrations the 79adc433 re-pin left behind (CL-8425)

vendor/intx/db/VENDORED-FROM

@@ -1,4 +1,4 @@
 Source: https://github.com/faremeter/interchange (packages/db)
-Commit: c1b5bb73ff4815414af44e4662214e054e9e70e2 (origin/main, 2026-09-06)
+Commit: 79adc433 (origin/main, 2026-09-17; src re-pinned in CL-8206, migrations completed in CL-8425)
 License: LGPL-2.1-only (see vendor/intx/LICENSE)
-Local modifications: exports map repointed from the upstream intx-src condition to direct TypeScript source resolution (types/default -> ./src/...); dist references removed. Upstream test files are not vendored (they import the unvendored @intx/inference-testing and @intx/test-harness test packages); only the tests covering a workbench delta are kept. CL-6324: workflow_definition_version gains a wire_projection jsonb column (migration 0089_workflow_definition_version_wire_projection.sql -- renumbered from 0086 as upstream took 0086/0087/0088; the journal keeps our original `when` values, which still sort after upstream's), schema/workflow-definitions.ts declares it, and workflow-definition-store.ts adds loadFrozenWireProjection (exported from src/index.ts) to read it back beside the approved wire hash. CL-6452: workflow_definition gains an origin column (migration 0090_workflow_definition_origin.sql; declared in schema/workflow-definitions.ts) marking the per-run record a folded run's deploy mints for itself, so launch and refresh resolve the hub-authored definition instead of the newest same-named row. Migration 0091_workflow_definition_version_tolerate_body_failure.sql rewrites the retired `onBodyFailure: "continue"` literal to upstream's `"tolerate"` inside stored wire projections. CL-4455: workflow_definition gains schedule_claimed_minute (migration 0092_workflow_definition_schedule_claimed_minute.sql; declared in schema/workflow-definitions.ts) so the hub's native ScheduleTrigger poller can CAS each UTC minute. CL-8162: the hub-side cron tick is deleted, so schedule_claimed_minute is dropped again (migration 0094_drop_workflow_definition_schedule_claimed_minute.sql, journal idx 94) and schema/workflow-definitions.ts no longer declares it. Workbench applies these files by sorted filename through scripts/db-setup.ts (replay-from-scratch with a filename ledger); the drizzle journal exists for drizzle-kit only. CL-7495 re-pin to c1b5bb73: upstream's 0089_tense_selene.sql (principal_key table) is renumbered to 0093_principal_keys.sql behind our four delta migrations, with journal idx 93 and a 0093_snapshot.json built from upstream's 0089 snapshot reconciled with the wire_projection/origin/schedule_claimed_minute columns; upstream 447ebb08's snapshot-chain repair (relinked 0087 prevId, workflow_run.credential_refs restored) is applied to 0087/0088. Our fork migrations 0089-0092 ship no drizzle snapshots (hand-written SQL, journal only), so there was no fork snapshot chain to repair.
+Local modifications: exports map repointed from the upstream intx-src condition to direct TypeScript source resolution (types/default -> ./src/...); dist references removed. Upstream test files are not vendored (they import the unvendored @intx/inference-testing and @intx/test-harness test packages); only the tests covering a workbench delta are kept. CL-6324: workflow_definition_version gains a wire_projection jsonb column (migration 0089_workflow_definition_version_wire_projection.sql -- renumbered from 0086 as upstream took 0086/0087/0088; the journal keeps our original `when` values, which still sort after upstream's), schema/workflow-definitions.ts declares it, and workflow-definition-store.ts adds loadFrozenWireProjection (exported from src/index.ts) to read it back beside the approved wire hash. CL-6452: workflow_definition gains an origin column (migration 0090_workflow_definition_origin.sql; declared in schema/workflow-definitions.ts) marking the per-run record a folded run's deploy mints for itself, so launch and refresh resolve the hub-authored definition instead of the newest same-named row. Migration 0091_workflow_definition_version_tolerate_body_failure.sql rewrites the retired `onBodyFailure: "continue"` literal to upstream's `"tolerate"` inside stored wire projections. CL-4455: workflow_definition gains schedule_claimed_minute (migration 0092_workflow_definition_schedule_claimed_minute.sql; declared in schema/workflow-definitions.ts) so the hub's native ScheduleTrigger poller can CAS each UTC minute. CL-8162: the hub-side cron tick is deleted, so schedule_claimed_minute is dropped again (migration 0094_drop_workflow_definition_schedule_claimed_minute.sql, journal idx 94) and schema/workflow-definitions.ts no longer declares it. Workbench applies these files by sorted filename through scripts/db-setup.ts (replay-from-scratch with a filename ledger); the drizzle journal exists for drizzle-kit only. CL-7495 re-pin to c1b5bb73: upstream's 0089_tense_selene.sql (principal_key table) is renumbered to 0093_principal_keys.sql behind our four delta migrations, with journal idx 93 and a 0093_snapshot.json built from upstream's 0089 snapshot reconciled with the wire_projection/origin/schedule_claimed_minute columns; upstream 447ebb08's snapshot-chain repair (relinked 0087 prevId, workflow_run.credential_refs restored) is applied to 0087/0088. Our fork migrations 0089-0092 ship no drizzle snapshots (hand-written SQL, journal only), so there was no fork snapshot chain to repair. CL-8425: the CL-8206 re-pin to 79adc433 moved src/schema (tenant domain lower-unique index, workflow_run_dispatch.sender_address, sidecar_allocation destroy_failed status) without its SQL; upstream's 0090_tenant_domain_lower_unique, 0091_workflow_run_dispatch_sender_address and 0092_sidecar_destroy_failed are vendored verbatim as 0095/0096/0097 (journal idx 95-97, no snapshots).

vendor/intx/db/migrations/0095_tenant_domain_lower_unique.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "tenant" DROP CONSTRAINT "tenant_domain_unique";--> statement-breakpoint
+CREATE UNIQUE INDEX "tenant_domain_lower_idx" ON "tenant" USING btree (lower("domain"));

vendor/intx/db/migrations/0096_workflow_run_dispatch_sender_address.sql

@@ -0,0 +1,21 @@
+ALTER TABLE "workflow_run_dispatch" ADD COLUMN "sender_address" text;--> statement-breakpoint
+-- Fail in-flight mail dispatches that predate the authenticated-sender
+-- requirement. They carry no persisted hub-verified sender, and neither
+-- fabricating one nor re-reading the signed From is permitted, so they are
+-- failed in place rather than delivered unauthenticated. Only unsettled
+-- (pending/acknowledged) mail rows are ever re-dispatched and reconstruct a
+-- mail.inbound frame; terminal (settled/failed) mail rows never do, so they
+-- keep their NULL sender under the status-scoped check below. On a fresh
+-- database this affects zero rows.
+UPDATE "workflow_run_dispatch"
+SET "status" = 'failed',
+	"failure_code" = 'sender_address_migration',
+	"failure_message" = 'in-flight mail dispatch predates the authenticated-sender requirement and carries no hub-verified sender',
+	"next_attempt_at" = NULL,
+	"delivery_lease_id" = NULL,
+	"delivery_lease_expires_at" = NULL,
+	"updated_at" = now()
+WHERE "kind" = 'mail'
+	AND "status" IN ('pending', 'acknowledged')
+	AND "sender_address" IS NULL;--> statement-breakpoint
+ALTER TABLE "workflow_run_dispatch" ADD CONSTRAINT "workflow_run_dispatch_mail_sender_check" CHECK ("workflow_run_dispatch"."kind" <> 'mail' or "workflow_run_dispatch"."status" in ('settled', 'failed') or "workflow_run_dispatch"."sender_address" is not null);

vendor/intx/db/migrations/0097_sidecar_destroy_failed.sql

@@ -0,0 +1,4 @@
+ALTER TABLE "sidecar_allocation" DROP CONSTRAINT "sidecar_allocation_status_check";--> statement-breakpoint
+DROP INDEX "sidecar_allocation_active_sidecar_idx";--> statement-breakpoint
+CREATE UNIQUE INDEX "sidecar_allocation_active_sidecar_idx" ON "sidecar_allocation" USING btree ("sidecar_id") WHERE "sidecar_allocation"."status" in ('provisioning', 'allocated', 'replacing', 'releasing', 'destroy_failed');--> statement-breakpoint
+ALTER TABLE "sidecar_allocation" ADD CONSTRAINT "sidecar_allocation_status_check" CHECK ("sidecar_allocation"."status" in ('pending', 'provisioning', 'allocated', 'replacing', 'releasing', 'destroy_failed', 'released', 'failed'));

vendor/intx/db/migrations/meta/_journal.json

@@ -659,6 +659,27 @@
       "when": 1789000000000,
       "tag": "0094_drop_workflow_definition_schedule_claimed_minute",
       "breakpoints": true
+    },
+    {
+      "idx": 95,
+      "version": "7",
+      "when": 1789100000000,
+      "tag": "0095_tenant_domain_lower_unique",
+      "breakpoints": true
+    },
+    {
+      "idx": 96,
+      "version": "7",
+      "when": 1789100000001,
+      "tag": "0096_workflow_run_dispatch_sender_address",
+      "breakpoints": true
+    },
+    {
+      "idx": 97,
+      "version": "7",
+      "when": 1789100000002,
+      "tag": "0097_sidecar_destroy_failed",
+      "breakpoints": true
     }
   ]
 }