Run dashboard migrations with dedicated CI credential

[suguanYang]

Summary

• run the main Drizzle migration directly in GitHub Actions with DATABASE_MIGRATION_URL mapped to DATABASE_URL
• remove the temporary Kubernetes migration Job path, avoiding runtime-role DDL failures and TTL log loss
• gate both staging pushes and production releases on migration success
• fail immediately with a clear error when the migration secret is missing
• add workflow contract tests for the credential, gating, and no-temporary-Job behavior

This fixes the staging CD failure observed on image staging-551bf60b: the runtime knowhere_runtime role correctly denied CREATE SCHEMA. The existing runtime secret remains unchanged.

Validation

• pnpm test — 28 files, 117 tests passed
• pnpm type-check — passed
• Biome check for changed workflow/test files — passed
• git diff --check — passed
• standards/spec review — no findings in changed files

Deployment and secret note

DATABASE_MIGRATION_URL is configured as a repository secret using the direct, non-pooled Neon migration-owner endpoint. It is used only in the migration job and is never passed to EKS runtime containers. No cloud resources were created or deleted by this PR.