v2.3.0

Changed

• database + cli skills: pgmq queues are documented as an IMPERATIVE resource, not a schema file or migration. cli/references/migration_system.md, cli/SKILL.md, cli/references/scaffold-map.md, cli/references/troubleshooting.md, database/SKILL.md (the supabase/database/ tree), and database/references/naming_conventions.md now place the pgmq queue in supabase/database/queue/ alongside config/, cron/, storage/, rbac/. The rule agents must learn: a queue (or any DO/pgmq/cron block) in schemas/ never reaches prod — prod is migrations-only and skips declarative db apply, so Supabase-managed objects must live in an imperative folder. Documented db resources --env <name> / --prod as the way to push just those to a cloud env.
• database skill: a permission-gated write must not be directly writable by authenticated. SKILL.md and root CONVENTIONS.md gained the rule that a write guarded by auth_verify_access(...) must go through a SECURITY DEFINER helper and grant the write to service_role only — RLS is isolation-only and can't see the permission check, so a direct authenticated write grant + isolation-only RLS is a weaker gate than the RPC. Includes the "tell" (if the RPC calls auth_verify_access, route the write through a DEFINER helper).