V2-04: Add forward-only v0.1 to v0.2 migrations and upgrade fixtures

[DevFoundry-labs]

Outcome

Prepare a forward-only migration path from v0.1 to v0.2 for secure intake, evidence schema v2, and retention/lifecycle operations.

Deliverables

• Add 0002_webhook_intake.sql for webhook_deliveries.
• Add 0003_evidence_v2.sql extending evidence_artifacts.
• Add 0004_retention_operations.sql adding cases.retention_until, cases.retention_policy_id, and legal_holds.
• Keep packaged and project-level migration copies aligned.
• Add a real v0.1 fixture upgrade test.
• Add clean-install and repeated-migration tests.
• Preserve newer-schema rejection.
• Document rollback boundaries; never edit migration 0001.

Acceptance criteria

• A v0.1 fixture migrates with existing cases, evidence, and audit data intact.
• Constraints, indexes, and foreign keys are validated.
• Running migration twice is safe.
• The built wheel contains all migrations.
• Migrations introduce no plaintext secrets or private keys.
• Migration field names and types are traceable to the approved V2 contracts.

Dependencies

• Blocked by V2-02: Freeze the webhook event and HMAC protocol #9.
• Blocked by V2-03: Freeze evidence schema v2 and the detached signature manifest #10.
• Remains planning-only until the M0 discovery gate in V2-01: Run design-partner discovery and publish the scope decision #8 passes.

Planning source

Derived from the local V2 planning package under .dev/v2/.