v0.5.0

The statesman conversion becomes production-safe. Dogfooding it against a
live database proved the single migration unusable: add_column's
ACCESS EXCLUSIVE lock lives until the end of the transaction, and the
full-table backfills inside it kept both tables unreadable — even for
SELECTs — for 26 minutes.

statecraft:from_statesman now generates three migrations along the
lock boundaries:

• _ddl — nullable columns only; on PostgreSQL 11+ the lock lasts
  milliseconds.
• _backfill — batched over parent-id ranges outside any DDL
  transaction, touching only rows still NULL: idempotent, rerunnable any
  time to catch up rows statesman wrote in between.
• _finalize — NOT NULL through NOT VALID → VALIDATE CONSTRAINT
  (readers never blocked), indexes built CONCURRENTLY — including the
  previously missing index on state the reference schema promises — a
  validated cascade FK, and the statesman columns dropped last.

The README recipe grows into a five-step runbook (ddl → backfill → switch
the code → catch-up backfill → finalize) with the lock mechanics explained
and one honest limit named: a text metadata column is still rewritten
under a lock during finalize.

Full Changelog: v0.4.1...v0.5.0