feat: transition module packages to database ABI v1

docs/development/testing.md

@@ -603,19 +603,21 @@ Ekklesia Module Package v1 (ADR 0049) is proven at three levels, all in `pnpm ve
 - `core/tests/module-package-verification.test.ts`: the verifier against hand-built archives,
   including what the packager never produces. A valid package verifies and extracts with normalized
   modes. A wrong digest, a corrupted or missing or unlisted file, disagreeing identities, an unknown
-  format, unknown transitional metadata, an incompatible target, Node.js range, SDK, or database
-  runtime, a missing entrypoint, a backend that imports something the package lacks, absolute and
+  format, unknown transitional metadata, an incompatible target, Node.js range, SDK, or legacy
+  database runtime, ABI metadata carrying a forbidden transitional runtime, malformed ABI schema
+  metadata, a missing entrypoint, a backend that imports something the package lacks, absolute and
   `..` paths, symbolic and hard links, device nodes and FIFOs, setuid and setgid entries, a second
   top-level directory, and a duplicate entry each fail with their own sanitized code. The backend
-  load check runs in a real child process.
+  load check runs in a real child process and selects the schema contract from the manifest.
 - `packages/module-pack/tests/`: the packager against generated fixture modules (payload contents,
   generated `package.json`, metadata, bundled backend with only built-in imports, refusal of native
   and platform-specific dependencies and of unknown or textless licences, notices, byte-identical
   archives, normalized tar and gzip headers), and end to end against the built module template:
   packed twice to identical bytes without changing the workspace's install state, verified by Core's
-  verifier, extracted elsewhere, and loaded with Node's own resolution hooks proving nothing outside
-  the package is resolved. Turbo builds the template and Core first, and runs the template's own
-  tests (which rebuild its UI in place) before these.
+  verifier with a deliberately different Core Drizzle version, extracted elsewhere, and loaded with
+  Node's own resolution hooks proving nothing outside the package is resolved. The package contains
+  module-side Drizzle but no `transitional.databaseRuntime`. Turbo builds the template and Core
+  first, and runs the template's own tests (which rebuild its UI in place) before these.
 
 ## The generic platform image and the reference deployment
 
@@ -635,7 +637,7 @@ These need Docker and build images locally; nothing is pushed or published.
   generic image with empty module storage. With `EKKLESIA_SMOKE_TOPOLOGY=split`, the same image also
   runs the installed-module lifecycle:
   - the module template is packaged by the canonical packager (Module Package v1, ADR 0049),
-    verified by the image's own verifier, and installed into module storage;
+    as ABI v1, verified by the image's own verifier, and installed into module storage;
   - its migration is planned and explicitly applied, and the API restarted;
   - a real browser mounts it;
   - it is removed and the API restarted, and Core still runs, migrations still plan and apply, and