Milestone 8: add pgsafe migration safety CLI

[nhatminh06]

Summary

• add a read-only PostgreSQL 16 migration analyzer backed by the real libpg_query AST
• provide deterministic text/JSON diagnostics, stable rules, thresholds, transaction-mode checks, stdin, explanations, and auditable statement suppressions
• add comprehensive fixtures/tests and GitHub-hosted static CI
• add separate canonical PostgreSQL lock demonstrations using only disposable objects
• preserve M9 backup/WAL/PITR and M10 observability scope

Static acceptance

• gofmt, go test ./..., go vet ./..., and standalone build passed
• compiled CLI fixtures: safe=0, unsafe=1, malformed=2, suppressed=0, JSON=1
• stdin, rules, explain, version, deterministic JSON, parser edges, and 500-statement sanity passed
• Terraform formatting/validation and existing shell syntax regression passed

Canonical PostgreSQL 16 runtime evidence

• plain CREATE INDEX: ungranted ShareLock observed; migration lock timeout at 2200 ms; queued HAProxy write also hit its bounded lock timeout
• CREATE INDEX CONCURRENTLY: valid index created in 451 ms while 25 writes succeeded through control-01:5000
• ALTER TABLE: ungranted AccessExclusiveLock observed; bounded lock timeout at 2199 ms
• staged CHECK: convalidated changed false to true; validation completed in 199 ms
• committed marker DDL observed on primary and both physical replicas
• zero remaining blocked M8 sessions

Final HA and cleanup

• one Patroni leader and two streaming replicas
• 3/3 etcd healthy; HAProxy backend matched primary; normal routed write passed; async policy retained
• final Terraform destroy removed 30 resources
• Terraform state=0, project domains=0, networks=0, volumes=0, .pgsentry absent

This PR is intentionally left open for review.