phase 1: Go foundation — module, migrations, domain, seed ingest

Core deliverables:
- Go module github.com/dtoro/oikos (Go 1.26.3)
- cmd/oikos: single binary with role subcommands (migrate, seed, export)
- 6 SQL migrations: ontology meta-schema, entity instances (UUID+slug,
  blast_radius recursive function), operations (signals/checks/approvals),
  cognition (classifications/executions/feedback/patterns/skills), policy,
  observability (TimescaleDB hypertables + CAGGs + retention)
- Domain layer: entity, signal, execution, classification, pattern, skill,
  approval, check types + 11 sentinel errors + lifecycle state machines
- DB layer: pgx pool, SQL splitter (handles 94436 and -- comments), migration
  runner, seed ingest (ontology+inventory+policy) with content-hash dedup
- Config: env-based with defaults, secrets redaction
- Observability: slog JSON logger with debug mode
- Infrastructure: Makefile, docker-compose.yml, multi-stage Dockerfile
  (distroless, CGO_ENABLED=0)

Verified end-to-end against timescale/timescaledb:2.17.2-pg16:
- 6 migrations applied (65 SQL statements)
- Seeds ingested: 6 lifecycles, 59 entity types, 46 relationship types,
  111 entities, 144 relationships, 4 risk classes, 27 approval rules,
  9 autonomy settings
- Idempotent: second seed run is a no-op (content hash matches)

Bugs fixed during implementation:
- TimescaleDB CAGGs can't run in a transaction -> splitSQL() executes
  statements individually
- Semicolons in -- comments treated as separators -> comment handling
- YAML keys source/target didn't match code's source_type/target_type
- yaml.Marshal produced YAML for JSONB columns -> json.Marshal

migrations/001_ontology.up.sql

@@ -0,0 +1,43 @@
+-- Migration 001: Ontology meta-schema (with inheritance, R3-1)
+-- Defines entity types, relationship types, lifecycle definitions, and seed versioning.
+
+CREATE TABLE lifecycle_defs (
+    id            TEXT PRIMARY KEY,
+    states        TEXT[] NOT NULL,
+    default_state TEXT NOT NULL,
+    terminal_states TEXT[] NOT NULL DEFAULT '{}',
+    transitions   JSONB NOT NULL,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE entity_types (
+    name          TEXT PRIMARY KEY,
+    parent_type   TEXT REFERENCES entity_types(name),
+    is_abstract   BOOLEAN NOT NULL DEFAULT false,
+    domain        TEXT NOT NULL,
+    layer         TEXT NOT NULL CHECK (layer IN ('meta','infrastructure','governance','cognition')),
+    description   TEXT,
+    lifecycle_id  TEXT REFERENCES lifecycle_defs(id),
+    attribute_schema JSONB,
+    schema_version INTEGER NOT NULL DEFAULT 1,
+    status        TEXT NOT NULL DEFAULT 'active',
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE relationship_types (
+    name          TEXT PRIMARY KEY,
+    inverse       TEXT,
+    source_type   TEXT NOT NULL REFERENCES entity_types(name),
+    target_type   TEXT NOT NULL REFERENCES entity_types(name),
+    cardinality   TEXT NOT NULL CHECK (cardinality IN
+                    ('one-to-one','one-to-many','many-to-one','many-to-many')),
+    description   TEXT,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE seed_versions (
+    file          TEXT PRIMARY KEY,
+    content_hash  TEXT NOT NULL,
+    applied_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);