upstreamDriftReports.updatedAt is missing $defaultFn, unlike ~30 sibling updatedAt columns

[JSONbored]

Context

src/db/schema.ts's file header (lines 3-6) documents a house rule for this schema: timestamp
columns named updatedAt must use a drizzle $defaultFn(() => nowIso()) so that an insert which
omits the column gets a real ISO-8601 timestamp instead of corrupting the column — the comment
explicitly references a prior incident where omitted timestamp columns got corrupted.

Roughly 30 updatedAt column definitions across the schema follow this rule (e.g. lines 23, 43, 104,
124, 139, 285, 449, 469, 485, and more). One does not: upstreamDriftReports.updatedAt (line 1037):

export const upstreamDriftReports = sqliteTable("upstream_drift_reports", {
  ...
  generatedAt: text("generated_at").notNull(),
  updatedAt: text("updated_at").notNull(),   // no $defaultFn(() => nowIso()), unlike every sibling
}, ...);

Current writers (upsertUpstreamDriftReport, updateUpstreamDriftReportIssue in
src/db/repositories.ts:1704-1746) always pass updatedAt explicitly today, so this doesn't
misbehave in practice yet — but it's a documented house-style violation and a trap for any future
insert path (a new writer, a migration script, a test fixture) that omits the column and relies on the
schema-level default that every sibling column already provides.

Requirements

• Add .$defaultFn(() => nowIso()) to upstreamDriftReports.updatedAt in src/db/schema.ts,
  matching the exact pattern used by any sibling updatedAt column in the same file.
• Do not change generatedAt or any other column on this table — this issue is scoped to updatedAt
  only.
• Do not change upsertUpstreamDriftReport/updateUpstreamDriftReportIssue's existing explicit
  updatedAt writes — they can stay as-is; this is a schema-level safety net, not a call-site
  refactor.

Deliverables

• upstreamDriftReports.updatedAt in src/db/schema.ts has .$defaultFn(() => nowIso()),
  matching its ~30 sibling updatedAt columns.
• A regression test (in whichever test file already covers upstream_drift_reports
  inserts/schema, e.g. alongside existing repositories tests for this table) asserting an insert
  that omits updatedAt gets a real ISO-8601 timestamp instead of a corrupted/empty value.

Test Coverage Requirements

This repo's Codecov patch gate is 99%+ of changed lines and branches (src/** is covered). The new
$defaultFn branch must be exercised by the new regression test above (an insert omitting
updatedAt).

Expected Outcome

upstreamDriftReports.updatedAt behaves identically to every other updatedAt column in the schema:
an insert that omits it gets a real timestamp, not a schema-level gap waiting for a future writer to
trip over.

Links & Resources

• src/db/schema.ts:1037 — the column to fix
• src/db/schema.ts:3-6 — the file header documenting the house rule and its origin incident
• src/db/repositories.ts:1704-1746 — current writers for this table

[linear-code]

JSO-5873