refactor(notary): separate migration coverage artifacts

[jeremi]

Summary

• keep the active PostgreSQL installer and attester in state_plane/migration.rs, while moving the byte-identical v1 schema into a compile-time included .sql file
• move the PostgreSQL conformance harness into state_plane/migration/tests.rs without changing its module path or test entry points, and update the unsafe-code inventory references
• instrument the existing PostgreSQL 16/17/18 conformance matrix with pinned cargo-llvm-cov 0.8.7, print the coverage summary, and upload an LCOV artifact per PostgreSQL version

Why

The previous 5,133-line Rust file combined production code, 1,727 lines of embedded SQL, and about 2,500 lines of tests that are intentionally ignored outside dedicated PostgreSQL conformance. Generic Rust coverage therefore made the active migration look almost entirely untested without showing the coverage produced by the conformance workflow.

This keeps the migration in place because it remains the production schema installer and runtime attestation contract. It makes the source layout and coverage results reflect that responsibility more accurately.

Verification

• verified the extracted SQL is byte-for-byte identical to the former raw string
• cargo test --locked -p registry-notary-server --lib: 446 passed, 6 ignored, 0 failed
• full normal-test coverage: registry-notary-server 71.02% lines; production migration.rs 5.26% lines
• PostgreSQL 18 conformance under coverage: passed; production migration.rs 94.90% lines and 95.00% functions
• generated the same LCOV artifact used by the workflow and confirmed it is non-empty
• just ci-preflight
• cargo fmt --all -- --check
• cargo clippy --locked -p registry-notary-server -p registry-notary --all-targets -- -D warnings
• actionlint .github/workflows/notary-postgres-conformance.yml
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cc6184c8e7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".