phase 2 (part 2): sqlc queries, audit/event helpers, event NOTIFY trigger

- sqlc.yaml + internal/db/queries/*.sql: typed queries for entities,
  relationships, ontology, operations (signals, events, audit,
  idempotency, entity_status)
- internal/db/sqlcgen/: generated Go from sqlc (pgx/v5)
- internal/observability/record.go: Audit() and Event() helpers that
  write in the caller's transaction (SG10). actorLabel is interim text
  identity in detail JSON until OIDC resolution lands; actor_id column
  exists but is not yet populated
- migrations/008: post-commit pg_notify trigger on events table for
  SSE fan-out (SG8/SG10)

internal/db/sqlcgen/models.go

@@ -0,0 +1,329 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.29.0
+
+package sqlcgen
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type AgentActivity struct {
+	ID            int64
+	Ts            time.Time
+	AgentID       uuid.UUID
+	SessionID     *string
+	ActivityType  string
+	ToolName      *string
+	EntityID      *uuid.UUID
+	InputSummary  *string
+	OutputSummary *string
+	DurationMs    *int32
+	TokenCount    *int32
+	Success       *bool
+	CorrelationID *string
+}
+
+type Approval struct {
+	EntityID        uuid.UUID
+	SubjectEntityID *uuid.UUID
+	Action          string
+	RiskClass       string
+	Kind            string
+	Payload         []byte
+	Status          string
+	TokenHash       *string
+	ExpiresAt       time.Time
+	DecidedAt       *time.Time
+	DecidedBy       *uuid.UUID
+	CreatedAt       time.Time
+}
+
+type ApprovalRule struct {
+	ID            uuid.UUID
+	EntityType    *string
+	Action        string
+	RiskClass     string
+	AutonomyLevel string
+	ScopeEntity   *uuid.UUID
+	Version       int32
+	UpdatedAt     time.Time
+}
+
+type AuditLog struct {
+	ID            int64
+	Ts            time.Time
+	ActorType     string
+	ActorID       *uuid.UUID
+	Action        string
+	EntityID      *uuid.UUID
+	Method        *string
+	Path          *string
+	StatusCode    *int32
+	Detail        []byte
+	SourceIp      *string
+	CorrelationID *string
+}
+
+type AutonomySetting struct {
+	Key       string
+	Value     string
+	Version   int32
+	UpdatedAt time.Time
+}
+
+type CheckDef struct {
+	EntityID   uuid.UUID
+	TargetID   *uuid.UUID
+	TargetType *string
+	Kind       string
+	Config     []byte
+	IntervalS  int32
+	TimeoutS   int32
+	Zone       *string
+	Enabled    bool
+	UpdatedAt  time.Time
+}
+
+type Classification struct {
+	EntityID          uuid.UUID
+	SignalEntityID    *uuid.UUID
+	TargetEntityID    *uuid.UUID
+	Action            string
+	RecommendedAction []byte
+	RiskClass         string
+	Route             string
+	BlastRadius       []uuid.UUID
+	PatternConfidence *float32
+	SkillID           *uuid.UUID
+	AutonomyCheck     *string
+	Reasoning         []byte
+	CorrelationID     string
+	CreatedAt         time.Time
+}
+
+type Entity struct {
+	ID               uuid.UUID
+	Slug             string
+	Type             string
+	Name             string
+	State            *string
+	Attributes       []byte
+	MaintenanceUntil *time.Time
+	Version          int32
+	CreatedAt        time.Time
+	UpdatedAt        time.Time
+}
+
+type EntityStatus struct {
+	EntityID    uuid.UUID
+	Health      string
+	LastCheckAt *time.Time
+	Details     []byte
+	UpdatedAt   time.Time
+}
+
+type EntityType struct {
+	Name            string
+	ParentType      *string
+	IsAbstract      bool
+	Domain          string
+	Layer           string
+	Description     *string
+	LifecycleID     *string
+	AttributeSchema []byte
+	SchemaVersion   int32
+	Status          string
+	CreatedAt       time.Time
+	UpdatedAt       time.Time
+}
+
+type Event struct {
+	ID            int64
+	Ts            time.Time
+	Type          string
+	EntityID      *uuid.UUID
+	Severity      string
+	Source        string
+	Data          []byte
+	CorrelationID *string
+}
+
+type Execution struct {
+	EntityID         uuid.UUID
+	ClassificationID *uuid.UUID
+	SignalEntityID   *uuid.UUID
+	TargetEntityID   *uuid.UUID
+	Action           string
+	RiskClass        string
+	ApprovalID       *uuid.UUID
+	AgentID          *uuid.UUID
+	SkillID          *uuid.UUID
+	SkillVersion     *int32
+	Status           string
+	Result           []byte
+	DurationMs       *int32
+	Verified         bool
+	CorrelationID    string
+	StartedAt        *time.Time
+	CompletedAt      *time.Time
+	CreatedAt        time.Time
+}
+
+type Feedback struct {
+	EntityID              uuid.UUID
+	ExecutionID           uuid.UUID
+	Outcome               string
+	Observation           *string
+	Lesson                *string
+	UnexpectedSideEffects []string
+	Tags                  []string
+	CreatedAt             time.Time
+}
+
+type IdempotencyKey struct {
+	Key          string
+	Actor        string
+	RequestHash  string
+	ResponseCode *int32
+	ResponseBody []byte
+	CreatedAt    time.Time
+}
+
+type Ledger struct {
+	Ts             time.Time
+	ExecutionID    uuid.UUID
+	TargetEntityID *uuid.UUID
+	Action         string
+	RiskClass      string
+	Status         string
+	Verified       bool
+	Route          *string
+	Reasoning      []byte
+	ApprovalStatus *string
+	DecidedBy      *uuid.UUID
+	AgentID        *uuid.UUID
+	CorrelationID  string
+}
+
+type LifecycleDef struct {
+	ID             string
+	States         []string
+	DefaultState   string
+	TerminalStates []string
+	Transitions    []byte
+	CreatedAt      time.Time
+}
+
+type MetricRollups1d struct {
+	Bucket      interface{}
+	EntityID    uuid.UUID
+	Metric      string
+	AvgValue    float64
+	MinValue    interface{}
+	MaxValue    interface{}
+	SampleCount int64
+}
+
+type MetricRollups1h struct {
+	Bucket      interface{}
+	EntityID    uuid.UUID
+	Metric      string
+	AvgValue    float64
+	MinValue    interface{}
+	MaxValue    interface{}
+	SampleCount int64
+}
+
+type MetricSample struct {
+	Ts       time.Time
+	EntityID uuid.UUID
+	Metric   string
+	Value    float64
+	Tags     []byte
+}
+
+type Pattern struct {
+	EntityID        uuid.UUID
+	AppliesType     string
+	Action          string
+	Pattern         string
+	Confidence      float32
+	EvidenceCount   int32
+	SuccessCount    int32
+	FailureCount    int32
+	Status          string
+	Quarantined     bool
+	Version         int32
+	LastValidatedAt *time.Time
+	CreatedAt       time.Time
+}
+
+type Relationship struct {
+	SourceID   uuid.UUID
+	TargetID   uuid.UUID
+	Type       string
+	Attributes []byte
+	ValidFrom  time.Time
+	ValidTo    *time.Time
+}
+
+type RelationshipType struct {
+	Name        string
+	Inverse     *string
+	SourceType  string
+	TargetType  string
+	Cardinality string
+	Description *string
+	CreatedAt   time.Time
+}
+
+type RiskClass struct {
+	Name             string
+	Description      *string
+	ApprovalRequired string
+	AutonomyAllowed  bool
+}
+
+type SeedVersion struct {
+	File        string
+	ContentHash string
+	AppliedAt   time.Time
+}
+
+type Signal struct {
+	EntityID        uuid.UUID
+	Kind            string
+	Severity        string
+	TargetEntityID  *uuid.UUID
+	CheckID         *uuid.UUID
+	Evidence        *string
+	LikelyCause     *string
+	State           string
+	OccurrenceCount int32
+	FirstSeenAt     time.Time
+	LastSeenAt      time.Time
+	FlapCount       int32
+	HoldDownUntil   *time.Time
+	MuteUntil       *time.Time
+	CreatedAt       time.Time
+	UpdatedAt       time.Time
+}
+
+type Skill struct {
+	EntityID     uuid.UUID
+	Version      int32
+	Name         string
+	Procedure    []byte
+	AppliesType  *string
+	Action       string
+	PatternIds   []uuid.UUID
+	Status       string
+	SuccessRate  *float32
+	ChangedBy    *uuid.UUID
+	ChangeReason *string
+	LastUsedAt   *time.Time
+	CreatedAt    time.Time
+}