Add durable credential registry and secret lifecycle

crates/remora-credentials/migrations/0004_intent_abandoning.sql

@@ -0,0 +1,29 @@
+-- Reconciler ownership claim: vault destruction runs only after an intent is
+-- moved to abandoning under the credential lock. Create/rotate materialize
+-- refuses non-vault_written intents, so a concurrent commit cannot land a
+-- durable version that points at material the reconciler is about to destroy.
+
+ALTER TABLE secret_write_intents
+    DROP CONSTRAINT secret_write_intents_status_check;
+
+ALTER TABLE secret_write_intents
+    ADD CONSTRAINT secret_write_intents_status_check CHECK (
+        status IN (
+            'prepared',
+            'vault_written',
+            'durable_committed',
+            'abandoning',
+            'abandoned'
+        )
+    );
+
+ALTER TABLE secret_write_intents
+    DROP CONSTRAINT secret_write_intents_written_has_version;
+
+ALTER TABLE secret_write_intents
+    ADD CONSTRAINT secret_write_intents_written_has_version CHECK (
+        (status = 'prepared' AND vault_kv_version IS NULL)
+        OR (status IN ('vault_written', 'durable_committed', 'abandoning')
+            AND vault_kv_version IS NOT NULL)
+        OR status = 'abandoned'
+    );