ci: guard migration versions (next free version, open-PR collision)

[sylphx-desk-services]

What

Add a migration-version guard to Migration Integrity. Added SQL files must sort above the base's newest version, have a unique version in their directory, and not collide with another open pull request. Diagnostics suggest the next free version.

Why

Parallel branches can choose the same version or land below a version already applied. Catch these cases before deployment rather than requiring deployment recovery.

Use immutable pull-request and merge-group base SHAs from the event and the existing full-history checkout, rather than fetching a mutable branch again. Guard-script changes select the migration lane too.

The failed Security Scan on the previous head rejected Next.js 16.3.6 for GHSA-cjq9-62q9-8jv4. Merged current main, which already pins Next.js 16.3.8 in both the manifest and lockfile. The audit remains unchanged and fail-closed; no duplicate dependency fix or audit exemption is added.

Testing

• Fixture coverage includes ordered, older, duplicate and open-PR-colliding migrations, a moved base, API unavailability, an immutable base without an origin/main ref, and missing-base refusal.
• Workflow-binding assertions and the regression suite run inside Migration Integrity without inheriting its GitHub credentials.
• Preserved the previous PR head in ancestry and merged main b1926fd. The diff against main contains only the migration guard, fixture tests and workflow integration. Git diff --check passed and the working tree is clean.
• Remote regression, frozen installation and production dependency audit could not start: Build reports no linked org/project/environment. Exact-head regression execution, Security Scan and full repository gates remain pending CI; no local test pass or new-head CI success is claimed.

No migrations or account data are modified by this PR. No production resources were changed during rework. Rollback is a source revert. Existing runner selection is unchanged.

[sylphx-desk-studio]

The migration guard checks added SQL versions against the immutable event base, catches duplicate and open-pull-request versions, and runs its regression fixtures in the selected migration lane. Migration Integrity, Security Scan and ci-ok succeeded at this head. No migrations or runtime account paths change.