Two forge processes overlap safely during a roll: drain contract, WAL, idempotent reconcilers, expand/contract migrations #875

Part of #873. Before the move rolls were zero-downtime with maxSurge 1 (the drain rollout). Write down and test the contract that makes that safe on one SQLite data dir: the old process drains (finishes runs it holds, closes streams with a resume hint, takes no new work) while the new one serves; busy timeouts and WAL on every connection; the reconciler, the warden, the sleeper and the crew dispatcher are idempotent when two processes run them for a minute; a migration never removes or renames a column the previous release reads (add now, remove next release), and the schema test asserts it for the last two releases. Done means: a rehearsal on a copy rolls two pods overlapping with zero refused requests and no duplicated run.

Closed by the steward: #902 (additive migrations guard, releases.json, the schema-additive gate test) and #909 (transactional queueing, webhook delivery leases per claim, drainStreams on shutdown, two-process tests) are merged. The minute-long overlap proof belongs to the release rehearsal (#873 part 4).