fix(db): fold seven Drizzle-schema identity tables into renameRepositoryIdentity

[kai392]

Summary

The Drizzle half of the rename-orphan gap (companion to the raw-SQL half, #8380/#8409, now on main). Seven src/db/schema.ts tables carry a repo_full_name identity column with live writers but were never covered by renameRepositoryIdentity, so a repo-rename webhook permanently disconnected a repo's BYOK provider key, Linear key, open bounties, review-suppression rules, pending agent approvals, issue-watch subscriptions, and command-feedback votes.

Each uses the fold strategy its real constraint requires, verified in schema.ts, reusing a shape already in the module:

Table	Constraint	Strategy
repositoryAiKeys, repositoryLinearKeys	repo_full_name PRIMARY KEY	fold-then-rename anchor, as repositories
bounties	UNIQUE (repo_full_name, issue_number)	fold on issue_number, as pullRequests/issues
reviewSuppression	UNIQUE (repo_full_name, category, path_glob, pattern_hash)	per-tuple fold, as checkSummaries
agentPendingActions	UNIQUE (repo_full_name, pull_number, action_class)	per-tuple fold, as pullRequestFiles
issueWatchSubscriptions	UNIQUE (login, repo_full_name)	single-column fold on login, as contributorRepoStats
githubAgentCommandFeedback	only unique index is (answer_id, actor_hash)	plain rename, as repoSnapshots

Two details verified rather than assumed:

• No id rewrites. Unlike pullRequests/issues/contributorRepoStats, none of these ids embed the repo name — five are crypto.randomUUID() at their writer, and bounties.id is an external id (String(issue.id), src/bounties/ingest.ts). Rewriting it would corrupt an external key.
• No isNull branching in the per-tuple folds: unlike checkSummaries.headSha, every fold column here is notNull.

Replaces #8416, which the engine auto-closed for a base conflict once #8409 (the raw-SQL half, same file) merged. This branch is rebuilt on current main — both halves now coexist, and the full suite passes with all thirteen tables' blocks present.

Closes #8379

Test plan

• Six new describe blocks in test/unit/repo-identity-rename.test.ts, each asserting the fold keeps the old row's real data (key ciphertext, bounty status, the maintainer's accepted pending-action) rather than the post-rename fragment, and that near-miss rows survive untouched — a suppression rule differing only by pattern_hash, another only by category, a pending action differing only by action_class, another by pull_number, a different watcher, a different repo's feedback
• github_agent_command_feedback asserts both rows survive (no unique index on that column, so nothing may fold)
• Suite green (75/75, including the seven raw-SQL blocks from fix(db): fold seven raw-SQL identity tables into renameRepositoryIdentity #8409 already on main — all pre-existing assertions unmodified)
• Local coverage on src/db/repo-identity-rename.ts: 157/157 lines, 43/44 branches — the single partial branch is the pre-existing repoParts ternary at line 67, outside this diff
• npm run typecheck clean
• CI validate

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.65%. Comparing base (ca066b2) to head (f03cb28).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8424      +/-   ##
==========================================
- Coverage   92.42%   89.65%   -2.78%     
==========================================
  Files         791       98     -693     
  Lines       79290    22864   -56426     
  Branches    23950     3894   -20056     
==========================================
- Hits        73283    20498   -52785     
+ Misses       4868     2187    -2681     
+ Partials     1139      179     -960     

Flag	Coverage Δ
shard-1	99.36% <100.00%> (+46.05%)	⬆️
shard-2	0.00% <0.00%> (-52.47%)	⬇️
shard-3	57.59% <65.21%> (+1.44%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/db/repo-identity-rename.ts	99.36% <100.00%> (+0.10%)	⬆️

... and 693 files with indirect coverage changes

[loopover-orb]

Important

🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪

🔍 LoopOver is reviewing…

AI analysis is in progress. This comment will update when the review is complete.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟪 Reviewing}

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.