feat(sync): bring the shared modules up to constructive-db main

[pyramation]

Summary

Upstreams every change the shared modules have accumulated in constructive-io/constructive-db@main (where they are actually developed) since the last feat: sync packages from constructive-db/pgpm-modules. Nothing is authored here: for each module the deploy/, verify/, revert/, pgpm.plan, extensions.json and __tests__/ trees are taken from constructive-db, then pgpm package regenerates sql/. Version metadata (package.json, *.control, Makefile) is untouched, so every module keeps its upstream version — the regenerated files are still --0.33.0/0.33.1.sql.

The drift was two-way, so this is a merge and not a copy. Direction was decided per file by last-modified date, then verified by reading the diff:

Kept from upstream (newer here, would have been deleted by a blind copy):

• the api_modules surface — metaschema_modules_public.api_surface_module (api_modules_table_id/_name + FK) and the app_scope.routing_tables() columns/joins that read it;
• metaschema-modules/__tests__ (information_schema → pg_constraint rewrite, testTimeout) and encrypted-secrets-table/__tests__.

Taken from constructive-db (notable ones):

• function-resolution — the catalog fast-path generation replaces the probe generation: probe.sql is deleted, catalog_location.sql added, and resolve() now returns owner_database_id and answers from the typed functions catalog with one indexed read per frame database (FUNCTION_RESOLUTION_CATALOG_UNAVAILABLE/FR001 when a frame database hosts function modules but no catalog). Plan requires move probe → catalog_location accordingly.
• partman — declarative extensions.json replaces the extensions/pg_partman deploy/verify/revert triple and its plan entry (the pg_partman schema, createSchema and grants are now declared, not scripted). pgpm-partman.control keeps its pg_partman requirement.
• app-scope — frames() re-keys the fall-through database frame by the execution database, so rows a tenant touches on a shared plane are keyed by the tenant's database_id, not the platform database hosting the plane.
• database-jobs — enqueue/add_job take an explicit db_id uuid DEFAULT jwt_private.current_database_id() instead of reading the claim inside the body, so a caller can act on behalf of another database.
• metaschema-schema — new metaschema_public.derives and domain_type tables, plus is_valid_step_up, policy, table and embedding_chunks changes.
• metaschema-modules — catalog_module.buckets_table_id, storage_module.catalog_module_id, billing_module.default_meter_catalog.

Two things had to change for this to be green.

PGPM_VERSION: 4.33.0 → 5.18.0. extensions.json is the pgpm 5 way of declaring an external extension; the 4.33 CLI reads the file (Installing external extension: pg_partman) but does not honour schema/createSchema, so pgpm test-packages --full-cycle died on ALTER DEFAULT PRIVILEGES IN SCHEMA partman with 3F000 schema "partman" does not exist. constructive-db has been on pgpm 5 for a while; the workspace already declares "pgpm": "^5".

A test fixture fix, pre-existing breakage in constructive-db's copies (that repo does not run the vendored module tests in CI, this repo does):

-  (..., apps_table_id, scope) VALUES ($1, $2, $3, ..., $3, 'app')
+  (..., apps_table_id, buckets_table_id, scope) VALUES ($1, $2, $3, ..., $3, $3, 'app')

catalog_module.buckets_table_id is NOT NULL DEFAULT uuid_nil() behind an FK to metaschema_public.table and there is no uuid_nil() sentinel row, so every insert in function-resolution's two suites failed (30 of 34 tests). The metaschema-modules FK snapshot moves 458 → 459 for that same new constraint.

Consumer-side re-vendor: constructive-io/constructive-db#2634.

Link to Devin session: https://app.devin.ai/sessions/60b2dc2dcb71403f9388d9785a9a78cf
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring