feat(dropguard): name-convention guard on every customer-data drop + migration-safety CI gate (truehomie D3)

[mastermanas805]

What

Task D3 (WAVE2-HANDOFF-2026-06-11) — layer 2 of the truehomie-db DROP hardening. Layer 1 (PR #50, guardedDrop) made every sanctioned drop auditable; this PR makes a mis-targeted drop unexecutable, and adds a migration-safety CI gate.

1. internal/dropguard — validates the target identity of every customer-data destruction: naming token (chokepoint) + final db/user identifiers (SQL sites). Refuses empty/garbage tokens, SQL metacharacters, system databases (postgres, template0/1, instant_customers, instant_platform, mongo admin/local/config) and admin roles (instanode_admin, instant_cust, doadmin, redis default). Deliberately permissive on token shape (uuid, dashless hex, pool-*, e2e cohort tokens all pass) so no legitimate legacy deprovision wedges — this repo auto-deploys.
2. Guard wiring (refusal = provisioner.drop.refused structured log + instant_provisioner_drop_total{outcome="refused"} + error to caller):
   • server.guardedDrop — poolident-resolved naming token validated BEFORE backend dispatch (covers postgres/redis/mongo/queue, shared + dedicated).
   • postgres local.Deprovision, cleanupProvisionPartial (rollback path that does NOT pass the chokepoint), dedicated.deprovisionLocal — FINAL constructed dbName/username validated right before DROP DATABASE/DROP USER.
   • mongo Deprovision — token guard before connect; per-candidate name guard (refused canonical = hard error, refused legacy candidate = skip).
   • redis local + dedicated — ACL DELUSER of any non-tenant-shaped username skipped (DELUSER default would brick the shared pod).
3. Migration-safety CI gate — scripts/check-migration-safety.sh (+ ci.yml step, copy-able to other repos): destructive DDL (DROP TABLE/DATABASE/SCHEMA/COLUMN/ROLE/USER, TRUNCATE, DELETE FROM without WHERE) in migrations/*.sql fails CI unless the file carries -- destructive: acknowledged <reason>. 6-fixture self-test runs first in CI.

Behavior change

NONE for legitimate flows — TestGuardedDrop_LegitimateForms_StillExecute asserts every real token shape still reaches the backend. Only invalid/system-targeted drops now fail (they previously executed).

Rule-17 coverage block

Symptom:        unidentified, non-audited DROP DATABASE/ROLE on postgres-customers (truehomie 2026-06-03, root cause OPEN)
Enumeration:    rg -in 'DROP DATABASE|DROP USER|DROP ROLE|DROP OWNED|dropdb|DropDatabase|dropUser|FLUSHDB|FLUSHALL|\.Drop\(|DELUSER' across provisioner + (read-only) api/worker/common @ origin/master
Sites found:    11 destructive sites in provisioner (pg local x2 incl. rollback, pg dedicated, pg k8s ns-delete, neon API, mongo db+user, redis DELUSER local+dedicated, redis SCAN+DEL, queue/storage ns-delete) + 2 in api (providers/db, providers/nosql — dev-only direct path, read-only repo, flagged in report)
Sites touched:  8 (all SQL/command drop sites in provisioner) + chokepoint covers the rest (k8s namespace deletes derive from the validated token); api sites NOT touched (read-only repo — escalated in task report)
Coverage test:  internal/server/drop_guard_test.go (AST guard, pre-existing) + dropguard 100% unit coverage + per-site refusal tests in postgres/mongo/redis/server packages
Live verified:  awaiting auto-deploy on merge; `/healthz` SHA check + `provisioner.drop` log line on next TTL reap will confirm (no destructive prod action taken)

Test evidence

• make gate — green (build + vet + go test ./... -short -count=1)
• golangci-lint run on changed packages — 0 issues
• internal/dropguard — 100.0% statement coverage; all changed lines in other packages covered (verified via go tool cover against the diff; remaining uncovered ranges are pre-existing branches outside this diff)
• mongo loop-branch tests verified against a live local mongo:7; redis tests run without a live server (unreachable-client + nil-client seams)
• scripts/check-migration-safety.sh --self-test — 6/6 fixtures

🤖 Generated with Claude Code