Sync SQL sources from constructive-db (trigger attachments, attribution, module tables)

[pyramation]

Summary

These modules are edited in constructive-io/constructive-db (its pgpm-modules/ tree) and published from here, and the two copies had drifted — this catches up the six packages whose SQL sources differ, so the next @pgpm/* release carries them.

What lands, by package:

• metaschema-schema — metaschema_public.function becomes a declarative definition row (kind IN ('reservation','sql','plpgsql','trigger'), arguments/returns/volatility/body_ast/api_exposed, with the reservation-carries-no-definition and trigger-signature CHECKs), and metaschema_public.trigger gains the customer trigger attachment: kind IN ('reservation','attachment'), function_id → function(id) ON DELETE RESTRICT, timing, events, for_each_row, when_ast. A reservation is a name a generator or introspection owns; an attachment is a row the physical CREATE TRIGGER is re-derived from. Also new: metaschema_public.identity_provider_registry.
• jwt-claims — strict claim readers (require_database_id, require_user_id, require_entity_id, require_entity_type) and jwt_private.assert_attribution(actor_id, entity_id, entity_type), which raises ATTRIBUTION_REQUIRED when a write carries neither an actor nor an entity (warn-only under jwt.strict_attribution = 'false').
• database-jobs — app_jobs.add_job / add_scheduled_job / run_scheduled_job default their attribution columns from the claims and go through assert_attribution, so a job can no longer be enqueued unattributed.
• app-scope — app_scope.actor_entity (actor/entity pair lookup) and app_scope.frame_owns (frame-chain ownership test for write-path guards).
• function-resolution — enqueue reads the execution database through require_database_id; new install_route_bindings and install_mantra.
• metaschema-modules — module-table drift, including catalog_module.app_store_identities_table_id and the repository/resource relationships.

Two test fixes the ported sources require (these vendored tests are not run in constructive-db, which is why they were stale there):

- INSERT INTO metaschema_modules_public.catalog_module (… bindings_table_id, scope)
+ INSERT INTO metaschema_modules_public.catalog_module (… app_store_identities_table_id, bindings_table_id, scope)

  await pg.query(`SELECT set_config('jwt.claims.database_id', $1, true)`, [TENANT_DB]);
+ // add_job attributes the job from the claims and refuses one with no actor
+ await pg.query(`SELECT set_config('jwt.claims.user_id', $1, true), …`, [ACTOR_ID]);
  await pg.one(`SELECT * FROM function_resolution.enqueue(task_identifier := 'email:send', scope := 'app')`);

sql/*.sql + *.bundle.tar.gz regenerated with pgpm package (pgpm 5.18.0, matching CI). Locally green: all 26 CI matrix packages, pgpm test-packages --full-cycle (27/27 deploy→verify→revert), and pnpm run policy:check. No version bumps here — releasing stays a separate lerna version / lerna publish from-package step.

Link to Devin session: https://app.devin.ai/sessions/fd9f9aa438b24c75b2861f1a9ffc0e3c
Open in Devin Desktop: https://app.devin.ai/desktop/session/fd9f9aa438b24c75b2861f1a9ffc0e3c?variant=devin
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring