Phase 10.4.5A: Add migration runtime

[josiahking]

Phase 10.4.5A — Migration Runtime

Adds the explicit, one-shot evolvephp/migration runtime.

Included

• explicit application/module migration ownership
• deterministic identifiers, checksums and ordering
• contributor-backed registry with no automatic discovery
• storage-neutral applied migration history
• pending / applied / drifted / orphaned-applied planning
• non-blocking migration lease and authoritative under-lock plan refresh
• sequential forward execution
• explicit None and Database transaction modes
• action/history failure distinction and terminal uncertain-state handling
• separate lease-cleanup failure reporting
• explicit Core migrate command
• read-only --dry-run and --status
• release package inventory 27 → 28

Release order:

job → scheduler → migration → insight

Validation

Local accepted evidence before push:

• Migration: 25 tests / 124 assertions
• Scheduler: 31 / 92
• Core: 361 / 1,373
• Database Contracts: 24 / 97
• Lock Contracts: 10 / 47
• Architecture: 103 / 17,050
• Documentation: 167 / 5,207
• root PHPUnit: 1,612 tests / 6,919 assertions / 3 skipped
• PHPStan: no errors
• Deptrac: 0 violations / 0 uncovered
• PHP-CS-Fixer: clean
• release validation: 28 packages
• root security audit: clean
• license policy: pass
• supply-chain validation: pass
• git diff --check: pass

Scope

Exactly 48 changed paths:

• 24 added
• 24 modified

Implementation commit:

c4bad449c49353cb0494cbd3bea905c93d1e94ad

Commit tree:

3ed9173532ff77990bf1bcee4870572bff6e32fe

Parent protected baseline:

968014a31cf38807472bb494c01ef8143c4a1088

Deferred security closure

The existing Laravel comparator Dependabot bundle is intentionally excluded from 10.4.5A and remains assigned to 10.4.5B:

• league/commonmark GHSA-3q6v-r5mr-hxv8
• league/commonmark GHSA-97jj-33gv-5xf9
• laravel/framework GHSA-jh5r-qr3c-85q8

No benchmark/comparator remediation is part of this PR.

Commit-ref exception

The temporary Phase 10.1–10.5.1 maintainer-local exception remains in effect for the deferred full split / prerelease-consumer / skeleton exact-ref validation. Normal PR CI remains authoritative for this PR.