fix(db): preserve immutable artifact persistence

[iamjr15]

Summary

• Fix generated media persistence by removing an unnecessary row lock on immutable output metadata.
• Keep serialization at the existing per-user advisory transaction boundary.
• Consolidate the pre-launch database history into one current-schema baseline and one snapshot.
• Enforce that the agent role can insert/read generated outputs but cannot update them.

Decisions Made

Decision	Choice	Reasoning
Concurrency boundary	Existing per-user advisory transaction lock	It already serializes reservation and finalization; a second row lock on immutable output rows was redundant.
Runtime permissions	Keep bounded INSERT/SELECT and no UPDATE	Generated output metadata is immutable after publication.
Migration history	One clean baseline	This is a pre-launch implementation and does not retain compatibility migrations.

How to Review

1. Review packages/db/src/artifact-upload-intents.ts for the transaction change.
2. Review scripts/supabase-target/index.ts for the immutable ACL assertion.
3. Verify packages/db/drizzle contains one SQL baseline, one snapshot, and one journal entry.

Test Plan

• pnpm --filter @cheatcode/db db:generate (no schema changes)
• pnpm turbo typecheck
• pnpm turbo lint
• pnpm turbo build
• Rebaseline the verified production Drizzle ledger and run migration dry-run
• Deploy the agent Worker
• Generate images in production with natural-language and explicit-action prompts

Linear

No Linear issue was provided for this production fix.

Plan

No repository plan document was required for this bounded fix.