feat(kt-db): execute_migration full-lifecycle executor (Phase 7 #57)

[charlie83Gs]

Summary

• New `execute_migration(session, *, graph_id, from_version, target_version, hops, ctx, workflow_run_id)` composes the three Phase 7 primitives already landed: `begin_migration` → `run_hop` per declared hop → `commit_migration` OR `fail_migration`.
• Stops at the first raising hop. Returns `MigrationResult` carrying `final_version` (what data actually reached), `applied_hops` (ordered), and repr'd `error` — workflow surfaces these in its final progress event without re-querying.
• Pure function. No Hatchet. Single session, no commits — caller owns tx boundaries.

What this is NOT

• Not the Hatchet workflow (feat(wiki-frontend): add homepage tabs, synthesis views, and fix definition rendering #57 wraps this in a task for crash durability via per-hop commits).
• Not the auto-dispatch hook (feat(worker-synthesis): store synthesis errors and add regeneration #58 composes `plan_auto_dispatch` + this executor).

Keeps the orchestration logic unit-testable against a real DB without Hatchet; the workflow layer becomes thin glue.

Test plan

• `test_single_hop_success` — v1→v2 happy path, graph lands unlocked at v2
• `test_multi_hop_success` — v1→v3, both audit rows persist
• `test_workflow_run_id_propagates_to_audit_rows`
• `test_graph_is_read_only_during_hop` — inspects live row from inside migration.run
• `test_failure_at_first_hop_stamps_origin_version`
• `test_failure_mid_plan_stamps_last_applied` — graph at v2 when v2→v3 raised (sync shape correctness)
• `test_remigrate_resumes_from_last_applied` — hop1 short-circuits on retry via run_hop's idempotent replay; commit clears status='error'
• `test_empty_hops_just_toggles_state` — defends contract for zero-hop plans

All 8 pass. Full `libs/kt-db/tests/integration` suite: 230 passed.

🤖 Generated with Claude Code

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}