- 0002_agents / 0003_agent_keys migrations per architecture v1.1 §4.4
(incl. (k8s_namespace, k8s_service_account) uniqueness for the signing
service's dual identity check and an agent_id, valid_from index for the
verification lookup path)
- idempotent seed db/trust/seeds/0001_phase1_agents.sql with the three
Phase-1 identities: agent-approval-service, agent-testagent-transform,
agent-dummy-sink (namespace agent-trust)
- new db CI job in validate.yml: runs postgres:16-alpine, migrate up ->
down 2 -> up, applies the seed twice, verifies three agents
Co-Authored-By: Paperclip <noreply@paperclip.ing>
