build(migrations): 固化 OIDC 迁移安全复核

为已进入主干且会重建约束的 OIDC 迁移增加 SHA-256 锁定的精确规则豁免，文件内容或违规类型变化时仍会拒绝发布。

生产只读预检确认受影响表规模很小，现有 6 条身份配置均为 schema v1，OIDC 会话和撤销水位均为空；新增校验器测试覆盖允许项和校验和篡改。

tests/ci/migrations-test.sh

@@ -54,6 +54,27 @@ expect_fail() {
   }
 }
 
+write_review() {
+  local repo=$1
+  local file=$2
+  local sha256=$3
+  local violations=$4
+
+  mkdir -p "$repo/scripts"
+  cat >"$repo/scripts/migration-safety-reviewed.json" <<JSON
+{
+  "version": 1,
+  "migrations": {
+    "$file": {
+      "sha256": "$sha256",
+      "allowedViolations": $violations,
+      "reason": "Reviewed by the migration test fixture."
+    }
+  }
+}
+JSON
+}
+
 repo=$(new_repo safe)
 base=$(git -C "$repo" rev-parse HEAD)
 cat >"$repo/apps/api/migrations/0002_expand_accounts.sql" <<'SQL'
@@ -91,6 +112,31 @@ printf 'ALTER TABLE accounts ADD COLUMN external_id text NOT NULL;\n' > \
 commit_all "$repo" incompatible
 expect_fail "$repo" "$base" 'non-null column addition'
 
+repo=$(new_repo reviewed)
+base=$(git -C "$repo" rev-parse HEAD)
+printf 'ALTER TABLE accounts ADD COLUMN external_id text NOT NULL;\\n' > \
+  "$repo/apps/api/migrations/0002_reviewed.sql"
+digest=$(shasum -a 256 "$repo/apps/api/migrations/0002_reviewed.sql" | awk '{print $1}')
+write_review \
+  "$repo" \
+  apps/api/migrations/0002_reviewed.sql \
+  "$digest" \
+  '["non-null column addition"]'
+commit_all "$repo" reviewed
+expect_pass "$repo" "$base"
+
+repo=$(new_repo reviewed_tampered)
+base=$(git -C "$repo" rev-parse HEAD)
+printf 'ALTER TABLE accounts ADD COLUMN external_id text NOT NULL;\\n' > \
+  "$repo/apps/api/migrations/0002_reviewed.sql"
+write_review \
+  "$repo" \
+  apps/api/migrations/0002_reviewed.sql \
+  aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \
+  '["non-null column addition"]'
+commit_all "$repo" reviewed_tampered
+expect_fail "$repo" "$base" 'checksum mismatch'
+
 repo=$(new_repo transaction)
 base=$(git -C "$repo" rev-parse HEAD)
 printf 'ALTER TABLE accounts ADD COLUMN nickname text; COMMIT;\n' > \