fix(db): preserve applied migration checksums

[haasonsaas]

Summary

• restore migrations/0002_agents.sql to the checksum already recorded in production
• move the intended tenant foreign keys into a new 0013 migration
• add a regression test that prevents edits to the applied migration

Root cause

The production Corpus database had already applied migration 2. A later documentation/tenancy change edited that file, so SQLx refused to start with migration 2 was previously applied but has been modified. This is the blocker observed on the live corpus-server deployment after #9370.

Fixes-Regression-Of: #9370

Verification

• cargo fmt --check
• cargo clippy -p corpus-core --all-targets -- -D warnings
• cargo test -p corpus-core (98 unit tests and all package integration/doc tests passed)
• migration 0002 checksum regression test passed

Post-deploy validation

Promote the new Corpus image, confirm the corpus-server pod reaches Ready, and verify migrations complete without checksum errors or repeated startup failures.