Wrap migration startup in `pg_advisory_lock` (multi-pod safety)

[peteski22]

Part of #257 — Phase 2 step (3).
RFC: #275.

Blocked by the PostgresStore implementation Phase 2 child.

Scope

Wrap command.upgrade(cfg, "head") in pg_advisory_lock(<stable-int>)
when running against PostgreSQL, so multi-pod startups don't race on
migrations. The lock key is a stable, well-known integer chosen for cq
and documented in the migration code. SQLite stays as-is — single
writer + WAL is enough (see #305).

Definition of Done

• TDD: failing test simulating concurrent startup against a
  testcontainers Postgres asserts only one process performs DDL.
• Full test suite green.
• Lint clean.
• Brief comment in the migration runner documenting the chosen lock
  key and why.