phase 1 review fixes: dedup edges, real export, validation, tests

Review of aa2ca0a found and fixed:
- re-ingest duplicated ALL edges (upsert conflicted on valid_from=now(),
  never fired) — migration 007 dedupes + partial unique index on current
  edges; upsert now targets it. Regression-tested.
- export was a stub that overwrote seeds/*.yaml with 11-byte "version: 1"
  files — implemented real deterministic export (ontology/inventory/policy,
  cognition-layer excluded); round-trip is byte-stable (tested)
- DB password leaked in startup logs (slog JSON bypasses String()) —
  Config now implements slog.LogValuer; regression-tested
- docker-compose had literal '***' as DB password — env-interpolated
- uuid.New() (v4) → uuid.NewV7() per ADR-0005
- no ontology validation on ingest — internal/ontology TypeTree: abstract
  instantiation rejected, relationship endpoints hierarchy-validated,
  cardinality enforced in-transaction, lifecycle states checked, default
  state applied (Phase 1 gate items, R3-1)
- getOrCreateEntityID swallowed non-ErrNoRows errors
- migration runner now holds a session advisory lock on one connection
- Makefile: hardcoded /opt/homebrew/bin/go → go; test-db target

Tests: 4 unit suites + 7 integration tests (env-guarded, throwaway DB per
run): migrate idempotent, seed idempotent + no dup edges, abstract/edge/
cardinality rejection, blast_radius cycle termination, export round-trip.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.yml

@@ -8,7 +8,7 @@ services:
     environment:
       POSTGRES_DB: oikos
       POSTGRES_USER: oikos
-      POSTGRES_PASSWORD: oikos_dev
+      POSTGRES_PASSWORD: ${OIKOS_DB_PASSWORD:-oikos_dev}
     ports:
       - "5432:5432"
     volumes:
@@ -28,7 +28,7 @@ services:
       postgres:
         condition: service_healthy
     environment:
-      OIKOS_DATABASE_URL: postgres://oikos:***@postgres:5432/oikos?sslmode=disable
+      OIKOS_DATABASE_URL: postgres://oikos:${OIKOS_DB_PASSWORD:-oikos_dev}@postgres:5432/oikos?sslmode=disable
     command: ["migrate"]
     restart: "no"
 
@@ -41,7 +41,7 @@ services:
       migrate:
         condition: service_completed_successfully
     environment:
-      OIKOS_DATABASE_URL: postgres://oikos:***@postgres:5432/oikos?sslmode=disable
+      OIKOS_DATABASE_URL: postgres://oikos:${OIKOS_DB_PASSWORD:-oikos_dev}@postgres:5432/oikos?sslmode=disable
       OIKOS_SEEDS_DIR: /app/seeds
     command: ["seed"]
     restart: "no"
@@ -56,7 +56,7 @@ services:
       seed:
         condition: service_completed_successfully
     environment:
-      OIKOS_DATABASE_URL: postgres://oikos:***@postgres:5432/oikos?sslmode=disable
+      OIKOS_DATABASE_URL: postgres://oikos:${OIKOS_DB_PASSWORD:-oikos_dev}@postgres:5432/oikos?sslmode=disable
       OIKOS_API_LISTEN: ":8090"
       OIKOS_ENV: dev
       OIKOS_DEBUG: "true"