Add sydtest-sqitch and sydtest-sqitch-persistent ## Summary - New package `sydtest-sqitch`: sanity checks for a sqitch project against a temporary PostgreSQL database (per-change round-trip, per-change idempotence, whole-plan deploy/revert/redeploy cycle). - New package `sydtest-sqitch-persistent`: layered on top, also asserts that the sqitch deploy produces the same schema as `persistent`'s automatic migration. - Reusable replacement for the bespoke migration sanity-check code currently sitting in `NorfairKing/nix-ci#295`. ## Design notes - ``SqitchSettings`` takes ``Path Abs Dir`` for the project dir and ``Path Abs File`` for the sqitch executable, plus an optional grandfather tag. - The grandfather tag is a single ``Maybe Text`` referring to a tag in ``sqitch.plan`` — changes at or before the tag are exempt from the idempotence check; changes after must be idempotent. No filename allowlist. - The per-change round-trip check skips rework heads (``stepIsReworkHead``) because sqitch's revert convention undoes the whole change rather than only the rework, making the per-step intermediate state empty rather than ``post(predecessor)``. The whole-plan cycle test still exercises these. - ``runSqitchPerChangeChecks``, ``runSqitchWholePlanCycle``, ``runSqitchPersistentChecks`` are exposed in ``IO`` so callers can wrap them in ``try`` for negative tests. ## Test plan - [x] ``stack test sydtest-sqitch sydtest-sqitch-persistent --pedantic`` — 16/16 + 5/5 - [x] ``nix flake check`` (pre-commit, hlint, ormolu, cabal2nix, hpack, cross-nixpkgs release builds) - [x] Toy fixtures cover each failure mode in isolation: ``toy-sqitch-ok``, ``toy-sqitch-non-idempotent``, ``toy-sqitch-broken-revert``, ``toy-sqitch-grandfathered`` (with and without the tag), and ``toy-sqitch-drift`` for the persistent variant - [ ] Replace bespoke code in ``NorfairKing/nix-ci#295`` with calls to these packages (separate PR on the nix-ci side)