sync: port the machine, repository and image module tables from constructive-db

[pyramation]

Summary

constructive-db vendors these modules under pgpm-modules/ and edits them in place, so the two trees drift until someone ports the changes back (last done in #119). Two modules had drift: types and metaschema-modules.

types — one new change: upload_ids(upload[]) -> text[]. It exists because an array of uploads has no indexable "which file is this?" expression. A scalar upload column answers that with (value ->> 'id'), which a btree expression index serves; an array cannot, so storage GC and the files→document sync trigger both key off this function, and metaschema_generators.file_ref_field emits a GIN index over it:

CREATE INDEX … USING gin (upload_ids(attachments));
-- GC / sync then ask:  WHERE upload_ids(col) && ARRAY[NEW.id::text]

IMMUTABLE STRICT (an index expression must be immutable) and it drops elements with no id — an upload naming only a url, which the domain allows, is not a reference to a files row, so it contributes nothing rather than a NULL that && would have to reason about.

metaschema-modules — three new module tables the platform now provisions:

• image_module — the central container image catalog.
• repository_module — repositories, events, workflows, builds, partitioned build_steps (step + test rows keyed into the build's log object by byte range), local change requests.
• machine_module — enrolled machines, sessions, and the append-only command ledger.

Plus the backlog that landed on constructive-db main since #119 and was never ported: internal_config_module, k8s_admission_module, the @module_table provenance comments on every module table (what tg_module_install_provenance attributes to an install), and the agent/catalog/resource/route module column additions.

Notes:

• config_secrets_user_module exists only upstream and is kept (plan line reinserted in place).
• jwt-claims, metaschema-schema and object-store still carry unported drift from constructive-db; out of scope here.
• sql/ artifacts regenerated with pgpm package; metaschema-modules snapshots re-recorded against the ported deploy tree; a new upload-ids.test.ts covers ordering, id-less elements, strictness, volatility and the GIN index path.
• A publish needs a version bump — 0.41.0 is already released and these changes add objects to it.

Link to Devin session: https://app.devin.ai/sessions/45a3052973e44fb2b78bca5a8a161b2e
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring