feat(storage): enforce CloudSession commit protocol

[xxhZs]

Summary

• add CloudSession, Activation, SessionLease, and immutable BundleRevision resource models
• enforce server-owned initial metadata/status and tenant-scoped idempotent Activation admission
• serialize each Session with FIFO admission, expiring leases, monotonically increasing epochs, and final commit fencing
• atomically commit BundleRevision metadata, Session head, Activation outcome, publication intent, and ordered resource changes
• replace the single-file migration runner with locked, versioned migrations that upgrade the existing version-1 schema safely

Correctness boundaries

• JSON idempotency canonicalization preserves integers beyond float64 precision and rejects duplicate object keys
• exact admission/commit replays return the existing result; changed input is rejected
• Session and Activation status cannot be initialized by callers
• tenant-scoped resource-change advisory locks prevent cursors from skipping late commits
• expired leases can be recovered with a higher epoch but cannot pass the final commit fence
• all provider, object-storage, Maka, and messaging effects remain outside the metadata transaction

Migration compatibility

The new runner recognizes a complete database created by the original version-1 runner, records that baseline in maka_cloud_schema_migrations, and applies version 2. Partial legacy schemas and unavailable applied versions fail closed. Concurrent first-time migration and full up/down round trips are covered against PostgreSQL.

Deliberate boundaries

This PR implements the PostgreSQL consistency boundary only. The public Cloud Agent API, Activation controller, Bundle object-storage adapter, Maka execution path, and publication worker remain follow-up work.

Testing

• go test -race ./...
• go vet ./...
• go build ./...
• MAKA_POSTGRES_TEST_URL="$DATABASE_URL" go test -race ./internal/store/postgres -count=1 -v
• git diff --check

Supersedes #4 with a clean implementation based on the current PostgreSQL authority and Store transaction architecture.