feat: add module migration contracts and validation

templates/module/README.md

@@ -1,9 +1,9 @@
 # Ekklesia module template
 
 This is the smallest supported backend-only Ekklesia module. It proves the static manifest,
-compiled runtime and schema entrypoints, capability registration, a module-owned Drizzle table, and
-logical storage-bucket declarations without pretending that migrations, API, or storage
-provisioning already exist.
+compiled runtime and schema entrypoints, capability registration, a module-owned Drizzle table, a
+generated module-owned migration, and logical storage-bucket declarations. Migration execution,
+API routing, and storage provisioning are intentionally not included.
 
 To create a module inside this repository:
 
@@ -15,12 +15,24 @@ To create a module inside this repository:
    module actually implements and consumes.
 5. Replace `src/server/index.ts` with backend behavior only. Its `defineModuleRuntime` ID and version
    must match the manifest; do not duplicate the rest of the manifest in TypeScript.
-6. Replace `src/schema/index.ts` with declaration-only Drizzle tables. Keep `createModuleTable` and
-   `defineModuleSchema` aligned with the module ID, and never import another module's schema.
-7. Run `pnpm install`, `pnpm build`, `pnpm modules:validate`, and `pnpm verify` from the repository
+6. Replace the pure Drizzle declarations in `src/schema/tables.ts` and keep its table prefix aligned
+   with the module ID. Keep the `defineModuleSchema` ownership wrapper in `src/schema/index.ts`
+   aligned too, and never import another module's schema.
+7. Update `drizzle.config.ts`, generate forward migrations with `pnpm migration:generate
+   --name=lowercase_name` from the module directory, and review the SQL. Keep each generated tag in
+   `drizzle/meta/_ekklesia.json`, classify it as `none` or `approval-required`, and change that
+   file's `moduleId` when renaming the template.
+8. Run `pnpm install`, `pnpm build`, `pnpm modules:validate`, `pnpm migrations:validate`, and
+   `pnpm verify` from the repository
    root. The declared production entrypoint is the compiled `dist/server/index.js`, not source
    TypeScript; the schema entrypoint is likewise compiled to `dist/schema/index.js`.
 
 Do not add UI components, styles, renderers, navigation, or layouts. Those belong to surfaces.
 Keep imports side-effect-free, register capabilities in `register`, acquire resources in `start`,
 and release them in `stop`.
+
+The migration directory uses the pinned stable Drizzle Kit `0.31.10` PostgreSQL journal and
+snapshot format. Migrations are forward-only and may modify only this module's objects. Offline
+validation treats SQL as opaque bytes, calculates SHA-256 from the exact contents, and never opens a
+database or executes SQL. Destructive declarations are review metadata, not automatic SQL
+classification or approval.