feat(gs): grant staff clearance to the Compliance and Debug accounts of one staff member

[Blume1977]

What changed

• Adds a production-only data migration granting staff KYC clearance to two more staff accounts held by one staff member: a Compliance account and a Debug account (user data 395822).
• The Compliance account is targeted through its wallet address and resolved to its user-data id in SQL. Its id cannot be looked up beforehand: every tool that could answer that question sits behind the very clearance gate this migration repairs. A wallet address is pseudonymous and public on-chain, so it may appear in this repo (precedent: the GSheet account in 019fbcf7 - Backfill staff verified names on PRD #4574). The match is case-insensitive so the EIP-55 casing rendered by the app cannot decide a boot-fatal assertion.
• Both rows receive the same reviewed identity, read from the single deployment variable STAFF_VERIFIED_NAME_395822 (keyed by the one account id known at review time). No plaintext personal name lives in the repository.
• Follows the runbook in docs/staff-kyc-clearance.md exactly: precondition is the NULL-total negation of the closing assertion, the update is coupled to a StaffVerifiedNameBackfill audit row via a data-modifying CTE, and the postcondition asserts the clearance predicate per account rather than name equality.
• Ships the migration spec in the shape of feat(gs): grant staff clearance to the Debug account #4590, including real-Postgres coverage for the two-target backfill, idempotence, blank-name repair, the derived-BlankChars pin, kept-divergent-name auditing, case-insensitive address resolution, both partial-failure shapes, and audit-suppression failure.

Why

Since #4572, staff clearance requires a populated verifiedName. The backfills so far (#4574, #4590) covered three accounts; the two accounts here were not among them and still answer every elevated endpoint with STAFF_KYC_REQUIRED — the entire Compliance tool and POST /gs/debug included. Self-service KYC cannot repair the Compliance account: the KYC flow rejects Compliance-role accounts outright (#3577).

Impact and deployment

• The migration is a no-op outside production.
• On production the deployment variable is mandatory; a missing/blank value or any unexpected target state aborts the migration transaction.
• STAFF_VERIFIED_NAME_395822 must be live in the production deployment configuration before this PR is merged to develop — auto-release-pr.yaml keeps a release PR open continuously, so develop is the last point where the order can still be arranged.
• The concrete name↔account mapping belongs in the private operations repo, not here.
• After the release deploy, clearance takes effect within ~90 seconds (clearance-sync crons); no re-login needed.

Checks

• node --check on the migration
• npm run format / eslint / tsc --noEmit clean
• New spec: 12 unit tests pass locally; the 12 real-Postgres tests run in CI (MIGRATION_TEST_PG service); sibling migration specs still pass
• Migration syntax gate (migration-psql-check) passes

[github-actions]

⚠️ Unverified Commits (1)

The following commits are not signed/verified:

• b3158eb feat(gs): grant staff clearance to the Compliance and Debug accounts of one staff member (Blume1977)

How to sign commits

# SSH signing (recommended)
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

# Re-sign last commit
git commit --amend -S --no-edit
git push --force-with-lease