Add sydtest-sqitch and sydtest-sqitch-persistent
## Summary
- New package `sydtest-sqitch`: sanity checks for a sqitch project against a temporary PostgreSQL database (per-change round-trip, per-change idempotence, whole-plan deploy/revert/redeploy cycle).
- New package `sydtest-sqitch-persistent`: layered on top, also asserts that the sqitch deploy produces the same schema as `persistent`'s automatic migration.
- Reusable replacement for the bespoke migration sanity-check code currently sitting in `NorfairKing/nix-ci#295`.
## Design notes
- ``SqitchSettings`` takes ``Path Abs Dir`` for the project dir and ``Path Abs File`` for the sqitch executable, plus an optional grandfather tag.
- The grandfather tag is a single ``Maybe Text`` referring to a tag in ``sqitch.plan`` — changes at or before the tag are exempt from the idempotence check; changes after must be idempotent. No filename allowlist.
- The per-change round-trip check skips rework heads (``stepIsReworkHead``) because sqitch's revert convention undoes the whole change rather than only the rework, making the per-step intermediate state empty rather than ``post(predecessor)``. The whole-plan cycle test still exercises these.
- ``runSqitchPerChangeChecks``, ``runSqitchWholePlanCycle``, ``runSqitchPersistentChecks`` are exposed in ``IO`` so callers can wrap them in ``try`` for negative tests.
## Test plan
- [x] ``stack test sydtest-sqitch sydtest-sqitch-persistent --pedantic`` — 16/16 + 5/5
- [x] ``nix flake check`` (pre-commit, hlint, ormolu, cabal2nix, hpack, cross-nixpkgs release builds)
- [x] Toy fixtures cover each failure mode in isolation: ``toy-sqitch-ok``, ``toy-sqitch-non-idempotent``, ``toy-sqitch-broken-revert``, ``toy-sqitch-grandfathered`` (with and without the tag), and ``toy-sqitch-drift`` for the persistent variant
- [ ] Replace bespoke code in ``NorfairKing/nix-ci#295`` with calls to these packages (separate PR on the nix-ci side)