A migration is proven against production's data, and a failed one says which #29

Pull #16 died as start: exited with code 1 before answering with a stack at the serve() call — a migration failing on a preview's copy of production data, reported as a stack trace nobody could act on. Every issue still on the map adds a migration, so make this failure loud, cheap to reproduce, and caught before it ships.

What done looks like

• src/db.ts wraps each migration so a failure names it: migration 6 failed: <sqlite message> on stderr, then a non-zero exit, and never a bare stack. The transaction still applies all-or-none.
• migrate refuses to run against a database whose recorded version is ahead of the list (a preview deployed from an older branch onto newer data) with a sentence saying so, rather than proceeding.
• src/db.test.ts gains a reusable helper — atVersion(n) or equivalent — that builds a database with the first n migrations and seeds a row in each table that exists, so any future migration can be tested against it in three lines. Existing cases move onto it.
• One case per shipped migration asserts that upgrading from the version before it keeps every seeded row and leaves PRAGMA integrity_check at ok.
• forge.json's test command also runs bun run src/db.ts --check against a temporary FORGE_APP_DATA, so a migration that cannot open its own database fails the check rather than the preview's boot.
• AGENTS.md's "To add a concept → A migration" gains one line: a migration ships with a test that upgrades a seeded database, because previews carry production's data.
• Tests: a deliberately broken migration (in the test only, never in the list) produces the named error and no partial schema; a database recorded ahead of the list is refused; the helper's seeded rows survive every real migration.

Files I expect to change: src/db.ts, src/db.test.ts, forge.json, AGENTS.md, README.md.

Risks: do not edit a migration that has run to make a test pass — if one is wrong, the fix is another migration. Keep the --check run pointed at a temporary directory so the check never touches real data. The error text goes to stderr and names the migration index and SQLite's message, nothing about a person or a row.

Fit: Hearth — a failure that says what broke, and a check that catches it before a person does. A person assigns; I do not.