deploy.yaml: add nodejs install (required for actions/checkout)
migrate.yaml: rewrite migration runner
- Use PGHOST/PGUSER/PGPASSWORD env vars (no inline -h/-U/-p flags)
- ON_ERROR_STOP=1 for strict error handling on push
- || true for dispatch (idempotent full replay)
- Verify schema after apply
- fetch-depth: 2 for diff detection