feat(migrate): EQL v3 support

[coderdan]

Makes @cipherstash/migrate (and the stash encrypt * CLI it backs) work with EQL v3 columns. Closes #648.

Draft — landing in phased commits. This first commit adds the keystone.

Design decisions (from #648)

• v3 cut-over: none — switch by column name. Backfill <col>_encrypted, app points at it, plaintext dropped later via encrypt drop. No v3 rename step.
• Version detection: auto-detect from the column's Postgres domain type. No new flag.

Phase 1 (this commit) — version detection

detectColumnEqlVersion(client, table, column): public.eql_v2_encrypted → v2, concrete eql_v3_* → v3, plaintext/not-found → null. Resolves schema-qualified tables via to_regclass. Unit-tested with a mocked pg client; zero change to existing v2 behaviour.

Remaining phases

2. v3 lifecycle — route by detected version: v3 skips the v2 config state machine (ready_for_encryption/migrate_config/activate_config/reload_config/count_encrypted_with_active_config) and the rename cut-over; it's backfill + state-tracking only.
3. Backfill verification against a real v3 column — the $1::jsonb write must satisfy the concrete eql_v3_* domain CHECK, and isEncryptedPayload must accept v3 storage payloads. Live-DB integration coverage (CI-only) on the existing v3 harness.
4. CLI wiring — stash encrypt backfill/drop become version-aware; encrypt cutover reports "not applicable" on a v3 column.
5. Docs/skills — drop migrate README's "targets EQL v2" caveat; update stash-encryption / stash-cli. Add a @cipherstash/migrate changeset before marking ready.

Refs #648
https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 294d136d-310e-45a2-bd71-093b997aced6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/migrate-eql-v3

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: af92d80

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR