feat(replay): record runtime identity; label compatibility; analyse first divergence

Snapshots, replays and experiments now record the runtime they ran under:
build (module version, VCS commit, modified tree, commit time, Go version,
platform), schema version, a digest of the non-secret configuration that
ignores secret and credential changes, personality version, policy digest,
model routing including per-mind overrides, prompt versions, deterministic
subsystem versions and timezone. A replay compares its identity with the
snapshot's and is an exact-candidate, a different-build (differences
listed) or incompatible (schema differs; the replay stops before running).
The first non-exact step is analysed into events only in the recording,
events only in the replay, and the components they belong to, labelled as
inferred; live model calls are named as their own source of difference.
Migration 0022 is additive; unrecorded identities are reported as such.

migrations/0022_runtime_identity.down.sql

@@ -0,0 +1,5 @@
+UPDATE replays SET status='failed' WHERE status='incompatible';
+ALTER TABLE replays DROP CONSTRAINT IF EXISTS replays_status_check;
+ALTER TABLE replays ADD CONSTRAINT replays_status_check CHECK (status IN ('running','done','failed'));
+ALTER TABLE replays DROP COLUMN IF EXISTS divergence, DROP COLUMN IF EXISTS identity_diff, DROP COLUMN IF EXISTS compatibility, DROP COLUMN IF EXISTS identity;
+ALTER TABLE snapshots DROP COLUMN IF EXISTS identity;

migrations/0022_runtime_identity.up.sql

@@ -0,0 +1,9 @@
+-- Runtime identity for reproducibility (review pass §7.2 item 9).
+ALTER TABLE snapshots ADD COLUMN IF NOT EXISTS identity jsonb NOT NULL DEFAULT '{}'::jsonb;
+ALTER TABLE replays
+  ADD COLUMN IF NOT EXISTS identity jsonb NOT NULL DEFAULT '{}'::jsonb,
+  ADD COLUMN IF NOT EXISTS compatibility text NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS identity_diff text[] NOT NULL DEFAULT '{}',
+  ADD COLUMN IF NOT EXISTS divergence jsonb NOT NULL DEFAULT '{}'::jsonb;
+ALTER TABLE replays DROP CONSTRAINT IF EXISTS replays_status_check;
+ALTER TABLE replays ADD CONSTRAINT replays_status_check CHECK (status IN ('running','done','failed','incompatible'));