phase 2 (part 2): sqlc queries, audit/event helpers, event NOTIFY trigger

- sqlc.yaml + internal/db/queries/*.sql: typed queries for entities,
  relationships, ontology, operations (signals, events, audit,
  idempotency, entity_status)
- internal/db/sqlcgen/: generated Go from sqlc (pgx/v5)
- internal/observability/record.go: Audit() and Event() helpers that
  write in the caller's transaction (SG10). actorLabel is interim text
  identity in detail JSON until OIDC resolution lands; actor_id column
  exists but is not yet populated
- migrations/008: post-commit pg_notify trigger on events table for
  SSE fan-out (SG8/SG10)

migrations/008_event_notify.up.sql

@@ -0,0 +1,24 @@
+-- Migration 008: post-commit event fan-out for the SSE stream (SG8/SG10).
+-- Events are INSERTed in the same transaction as the state change; pg_notify
+-- fires at COMMIT, so subscribers only ever see committed events. Payload is
+-- kept minimal (NOTIFY has an 8000-byte limit); consumers needing the full
+-- event fetch it by id.
+
+CREATE OR REPLACE FUNCTION notify_oikos_event() RETURNS trigger AS $$
+BEGIN
+    PERFORM pg_notify('oikos_events', json_build_object(
+        'id', NEW.id,
+        'ts', NEW.ts,
+        'type', NEW.type,
+        'entity_id', NEW.entity_id,
+        'severity', NEW.severity,
+        'source', NEW.source,
+        'correlation_id', NEW.correlation_id
+    )::text);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS trg_events_notify ON events;
+CREATE TRIGGER trg_events_notify AFTER INSERT ON events
+    FOR EACH ROW EXECUTE FUNCTION notify_oikos_event();