feat: add module migration contracts and validation

docs/development/repository-workflow.md

@@ -19,6 +19,7 @@ pnpm format:check  # formatting without mutation
 pnpm lint          # Biome recommended rules
 pnpm boundaries    # architectural directions, UI ownership, and cycles
 pnpm modules:validate # installed module manifests, compatibility, and dependency graph
+pnpm migrations:validate # offline module migration inventory and exact checksums
 pnpm typecheck     # strict TypeScript
 pnpm test          # Vitest
 pnpm build         # Turborepo package build graph
@@ -35,6 +36,11 @@ must produce the compiled JavaScript entrypoints declared by their static manife
 schema entrypoints are loaded and validated for table ownership, namespacing, duplicates, and
 foreign-key isolation; this command does not connect to PostgreSQL or run migrations.
 
+`pnpm migrations:validate` also builds first, completes static module discovery, and atomically
+checks every declared stable Drizzle migration directory. It reports dependency-first module
+inventories and exact SHA-256 checksums without importing module code, connecting to PostgreSQL, or
+executing SQL. Modules with no migration history are valid.
+
 CI runs `pnpm ci:verify`, which adds Compose configuration validation to `pnpm verify`. A separate
 CI job runs the live infrastructure smoke test so code-only local verification does not require
 Docker. The explicit suffix avoids pnpm's built-in `ci` install command.