deploy.yaml: add nodejs install (required for actions/checkout) migrate.yaml: rewrite migration runner - Use PGHOST/PGUSER/PGPASSWORD env vars (no inline -h/-U/-p flags) - ON_ERROR_STOP=1 for strict error handling on push - || true for dispatch (idempotent full replay) - Verify schema after apply - fetch-depth: 2 for diff detection