Add guarded CLA production data migration

[ttenneb]

Summary

• add a production-only CLA survey-data cutover changelog with integrity gates
• add retry-safe CLA owner bootstrap and manifest-gated legacy account cleanup
• add Terraform/SSM cutover controls, rollback DB override, workflow serialization, and runbook

Validation

• API tests: 56 passed
• Terraform validate passed
• Liquibase master and cutover validation passed
• fresh universal changelog integration passed on PostgreSQL 15
• seeded legacy cutover, bootstrap retry, and cleanup integrations passed on PostgreSQL 15
• production read-only preflight and final encrypted snapshot completed