fix(migrate): auto-migrate pass ownership — column-before-index sequencing and FK on_delete reconciliation

[0x054]

Closes #324. Closes #325.

Both issues are auto-migrate gaps found by Pinch's M7 CP0 scratch-verification spike. One PR, one commit per slice, per the agreed plan (grilled and confirmed with the owner; decisions recorded in ADR-0010 and CONTEXT.md).

#324 — create pass fired index DDL at existing tables

The reported "index before column" crash was not in the reconcile plan (which already orders ADD COLUMN before CREATE INDEX): internal_migrate first runs the create pass, which executed every model's index DDL even when CREATE TABLE IF NOT EXISTS no-opped on an existing table. A new composite unique referencing not-yet-added columns died right there — before the reconciliation pass could add them. On SQLite it was worse than a crash: the double-quoted-string fallback silently built the unique index over a string constant.

Fix: the create pass introspects live table names once and skips existing tables entirely, enforcing the already-documented contract ("existing tables are left untouched unless migrate_updates is set"). Index reconciliation on existing tables stays where it already lives, correctly ordered, in migrate_updates. Deliberate behavior change (ADR-0010): plain auto_migrate no longer creates new indexes on live tables — that undocumented convenience was the crash vector and had two competing owners of index creation.

#325 — FK on_delete drift was silently ignored

Live FK constraints were never introspected at all (live_columns_to_schema_ir hardcoded foreign_keys: vec![]), so CASCADE → SET NULL on an existing model changed nothing and warned about nothing — and Pinch's "sever, never destroy" disconnect would cascade-delete user history on upgraded installs.

Fix: migrate_updates now introspects live FKs (pg_constraint / PRAGMA foreign_key_list) into the old IR and diffs each declared FK against the live constraint on its column:

• Postgres: a ferro-owned (fk_-named) constraint with definition drift (on_delete, target) is rebuilt — DROP CONSTRAINT + ADD CONSTRAINT under the canonical name, inside the existing per-table transaction. A declared FK missing entirely from an existing column is added. A drifting constraint ferro does not own is warned about, never altered (mirroring the idx_*/uq_* index-ownership policy).
• SQLite: constraints cannot be altered in place; every FK drift warns loudly — silence was the only unacceptable outcome.

Verification

• Both Pinch scratch shapes are regression tests at the connect() seam (tests/test_auto_migrate.py), plus plan-level DDL goldens (tests/test_migrate_plan.py) and Rust diff/emission tests (crates/ferro-migrate/src/tests.rs).
• Full suite green on both backends: 1688 passed (sqlite + postgres matrix, local PG 18), cargo test --no-default-features --features testing 203 passed, just check clean.
• Cross-emitter parity (I-1): rebuilt constraints keep the canonical fk_<table>_<col>_<to_table> name; test_alembic_autogen_after_migrate_updates_is_idempotent stays green.

Docs

CONTEXT.md gains four terms (create pass, reconciliation pass, ferro-owned artifact, constraint rebuild); ADR-0010 records the pass-ownership decision and its rejected alternatives; the migrations guide, architecture page, FAQ, and connect()/create_tables()/migrate() docstrings document the new coverage per backend.