phase 1 review fixes: dedup edges, real export, validation, tests

Review of aa2ca0a found and fixed:
- re-ingest duplicated ALL edges (upsert conflicted on valid_from=now(),
  never fired) — migration 007 dedupes + partial unique index on current
  edges; upsert now targets it. Regression-tested.
- export was a stub that overwrote seeds/*.yaml with 11-byte "version: 1"
  files — implemented real deterministic export (ontology/inventory/policy,
  cognition-layer excluded); round-trip is byte-stable (tested)
- DB password leaked in startup logs (slog JSON bypasses String()) —
  Config now implements slog.LogValuer; regression-tested
- docker-compose had literal '***' as DB password — env-interpolated
- uuid.New() (v4) → uuid.NewV7() per ADR-0005
- no ontology validation on ingest — internal/ontology TypeTree: abstract
  instantiation rejected, relationship endpoints hierarchy-validated,
  cardinality enforced in-transaction, lifecycle states checked, default
  state applied (Phase 1 gate items, R3-1)
- getOrCreateEntityID swallowed non-ErrNoRows errors
- migration runner now holds a session advisory lock on one connection
- Makefile: hardcoded /opt/homebrew/bin/go → go; test-db target

Tests: 4 unit suites + 7 integration tests (env-guarded, throwaway DB per
run): migrate idempotent, seed idempotent + no dup edges, abstract/edge/
cardinality rejection, blast_radius cycle termination, export round-trip.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/db/pool.go

@@ -39,11 +39,27 @@ func New(ctx context.Context, databaseURL string) (*Pool, error) {
 	return &Pool{pool}, nil
 }
 
+// migrationLockKey is the advisory-lock key serializing migration runs —
+// two concurrent `oikos migrate` invocations must not interleave DDL.
+const migrationLockKey = 0x01c05e5
+
 // Migrate runs all embedded forward migrations in order.
-// Uses a schema_migrations table to track applied versions.
+// Uses a schema_migrations table to track applied versions. The whole run
+// happens on one connection holding a session advisory lock.
 func (p *Pool) Migrate(ctx context.Context) error {
+	conn, err := p.Acquire(ctx)
+	if err != nil {
+		return fmt.Errorf("acquire migration conn: %w", err)
+	}
+	defer conn.Release()
+
+	if _, err := conn.Exec(ctx, "SELECT pg_advisory_lock($1)", migrationLockKey); err != nil {
+		return fmt.Errorf("acquire migration lock: %w", err)
+	}
+	defer conn.Exec(context.WithoutCancel(ctx), "SELECT pg_advisory_unlock($1)", migrationLockKey)
+
 	// Create tracking table if not exists
-	_, err := p.Exec(ctx, `
+	_, err = conn.Exec(ctx, `
 		CREATE TABLE IF NOT EXISTS schema_migrations (
 			version INT PRIMARY KEY,
 			applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
@@ -76,7 +92,7 @@ func (p *Pool) Migrate(ctx context.Context) error {
 
 		// Check if already applied
 		var applied int
-		err := p.QueryRow(ctx,
+		err := conn.QueryRow(ctx,
 			"SELECT COUNT(*) FROM schema_migrations WHERE version = $1", version).Scan(&applied)
 		if err != nil {
 			return fmt.Errorf("check migration %d: %w", version, err)
@@ -99,12 +115,12 @@ func (p *Pool) Migrate(ctx context.Context) error {
 			if stmt == "" {
 				continue
 			}
-			_, err := p.Exec(ctx, stmt)
+			_, err := conn.Exec(ctx, stmt)
 			if err != nil {
 				return fmt.Errorf("exec migration %s stmt %d: %w", fname, i+1, err)
 			}
 		}
-		_, err = p.Exec(ctx, "INSERT INTO schema_migrations (version) VALUES ($1)", version)
+		_, err = conn.Exec(ctx, "INSERT INTO schema_migrations (version) VALUES ($1)", version)
 		if err != nil {
 			return fmt.Errorf("record migration %d: %w", version, err)
 		}