The control plane migrates before it serves

The mesh replaced its own control plane with a build carrying a migration, applied none of it, and
then refused every build it recorded for three quarters of an hour while reporting itself healthy
(novox/hq 04-ISSUES/133). The module now declares the step ADR 0052 prescribes: a run-once
`migrate` before the server, re-run whenever the image moves because the image is part of a step's
digest, and gating — a migration that fails stops the new server from starting rather than letting
it serve against a schema it does not have.

module.json

@@ -34,6 +34,30 @@
       "path": "/var/lib/mesh/mesh-controller",
       "mode": "0700"
     },
+    {
+      "id": "migrate",
+      "type": "container",
+      "name": "mesh-controller-migrate",
+      "run-once": true,
+      "network": "host",
+      "args": [
+        "migrate"
+      ],
+      "env": {
+        "MESH_STORE_INVENTORY_FILE": "/run/secrets/inventory",
+        "MESH_STORE_IDENTITY_FILE": "/run/secrets/identity",
+        "MESH_STORE_LICENCES_FILE": "/run/secrets/licences",
+        "MESH_STORE_INVENTORY_PORT": "${seat:mesh-store:5432}",
+        "MESH_STORE_IDENTITY_PORT": "${seat:mesh-store:5432}",
+        "MESH_STORE_LICENCES_PORT": "${seat:mesh-store:5432}"
+      },
+      "volumes": [
+        "/var/lib/mesh/mesh-controller/inventory:/run/secrets/inventory:ro",
+        "/var/lib/mesh/mesh-controller/identity:/run/secrets/identity:ro",
+        "/var/lib/mesh/mesh-controller/licences:/run/secrets/licences:ro"
+      ],
+      "artifact": "server"
+    },
     {
       "id": "server",
       "type": "container",