chore: commit the pgpm bundle artifacts

[pyramation]

Summary

pgpm package emits sql/<name>--<version>.bundle.tar.gz next to the generated .sql, and pgpm deploy --fast uses it to deploy in one round-trip (verify sha256 → single execute → bulk-insert the pgpm_migrate ledger). None of the 27 modules had one committed, so every consumer silently took the slow path of rebuilding from deploy/. This adds all 27 (532 KB total) plus an AGENTS.md section describing the artifact.

The tarballs are byte-reproducible — the archive entry is written with a zeroed mtime — so pgpm package on unchanged sources is a no-op diff and CI can't drift on them:

$ sha256sum sql/pgpm-base32--0.33.0.bundle.tar.gz; pgpm package; sha256sum sql/pgpm-base32--0.33.0.bundle.tar.gz
ea32ede555d46828de6fcd4596971eab6b9205e27231464be56292cc57e2b6c5  (identical)
$ tar tzvf sql/pgpm-base32--0.33.0.bundle.tar.gz
-rw-r--r-- 0/0  22782 1970-01-01 00:00 pgpm-bundle.json

Only new files; no .sql, plan or source changed. Requires the pgpm 5 CLI, which this repo's CI moved to in #109.

Link to Devin session: https://app.devin.ai/sessions/60b2dc2dcb71403f9388d9785a9a78cf
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring