feat(s03): additive migration for task requirements, rehearsed on a restored store

[im-tyler]

What

S03 storage, finished to the boundary the programme draws: migration
008-ship-task-requirements for src/task-requirements.ts (the drafted
accepted/waived requirements store), rehearsed on a restored copy of the
real store. No write path is enabled — taskRecord() stays a
read-only projection; wiring the store into enqueue/run page remains
future work.

Migration shape

Follows the 006/007 new-table convention exactly (the most recent table
additions, PRs #41/#51, add no migration at all; 006/007 exist to give a
new table the two guards that only a migration entry provides):

• needed(): write-shaped probe (hasColumns, never a SELECT — Nucleus
  resolves unknown SELECT columns to NULL); false when the table is
  absent, because the store's own CREATE TABLE IF NOT EXISTS creates it
• run(): rename-aside + CREATE TABLE matching the store DDL
  (enforced by the DDL-parity test); nothing copied (no other shape was
  ever released), nothing dropped — same as 006/007
• recorded once in ship_migrations under the KV lock; replay is a no-op

Rehearsal (receipt: evals/receipts/2026-10-04-s03-requirements-migration.json)

Driver scripts/check-task-requirements-migration.mjs (the
check-intake-concurrency isolation contract:
SHIP_ISOLATED_CHECK=1 + NUCLEUS_URL), run against a throwaway
engine on a private docker network holding the verified
pre-80c9187-shadow-deploy-2026-10-04 backup. Live ship-*
containers and /deployments/ship were never touched (verified Up
before and after, no restart); only the proof container/network/dir were
created and removed.

• Before/after: 45 tables, 37 populated, 4223 rows — identical after
  migrate() except ship_migrations 7 → 8 (the 008 ledger row). The
  applied-ids list is empty because the table does not exist on the real
  store (the store is unwired): ledger-only is the designed path; the
  rename-aside limb is covered by the unit tests against a stale shape.
• Idempotency: second migrate() applied nothing (12 ms).
• Real-engine store proof (replacing the unit-test fake): the store
  DDL creates the table; idempotent add; different content under the
  same id refused via the primary key; waiver exactly-once via the
  conditional UPDATE; waived requirements stay listed. Proof rows
  deleted afterwards (final count 0, everything else unchanged).
• Timings: engine boot 3 s, check wall 951 ms, migrate 34 ms.

Tests

• 008 probes ship_task_requirements write-shaped, and is a no-op on a fresh install
• 008 is ledger-only on a current-shape table, and replay is a no-op
• DDL-parity owner entry for task-requirements.ts
• Existing task-requirements (14) / task-record (8) tests unchanged and
  green
• Full suite: 2163 + 222 pass, 0 fail, 1 documented local skip
  (grader-sensitivity port 8901; the one failure seen first was the
  documented environmental web/node_modules absence in a fresh
  worktree, fixed by installing web deps)

Not done (deliberate)

Wiring into enqueue + run page, accept/waive authorisation on approval
grants, feeding waived/active requirements into taskRecord()
acceptance, versioned plans, lost-response / two-tab / steer scenarios
on a real run — all still listed on the programme's S03 rollout row.

Do not merge from this session.