chore(api): drop deprecated patch_policies.sources column (#3151)

[ToddHebebrand]

Summary

Contract phase of the third-party update ring auto-approve expand/contract plan (docs/superpowers/specs/vuln-patch/2026-08-04-third-party-update-ring-auto-approve-design.md). The expand phase (#3150) removed every reader and writer of patch_policies.sources; this PR drops the column itself.

• Migration 2026-08-14-drop-patch-policies-sources.sql: ALTER TABLE patch_policies DROP COLUMN IF EXISTS sources; — idempotent, no inner transaction.
• Schema: removed the deprecated sources column definition + deprecation comment from apps/api/src/db/schema/patches.ts (patchSourceEnum itself stays — still used by patches.source).
• Dead strips removed: with the column gone from the schema, a full-row select can no longer return a sources key, so the defensive const { sources: _sources, ...rest } strips in routes/updateRings.ts (detail endpoint) and services/aiToolsPolicyPrereqs.ts (manage_update_rings get) are removed. Tests updated accordingly; the not.toHaveProperty('sources') response assertions are kept as regression guards.
• migrateToConfigPolicies.ts: primary.sources ?? ['os'] becomes a hardcoded ['os']. This is the compile-time handoff feat(patching): third-party auto-approval as a first-class Update Ring control #3150 deliberately set up — its comment said the DROP COLUMN "removes the Drizzle field, which breaks this line at compile time and forces this script to be updated (or deleted) in the same PR." The retained caveat: the script is a one-shot, not a repeatable sync, so re-running it for a legacy partner whose ring already opted into third-party auto-approve would silently reset that opt-in.
• No cascade/export-registry changes needed: patch_policies is partner-owned (no org_id, no device_id), so it appears in none of the cascade or export-policy lists.

⚠️ MERGE GATE — still NOT satisfied as of 2026-08-07

• feat(patching): third-party auto-approval as a first-class Update Ring control #3150 merged — 2026-08-05, f146d4027.

• A release containing feat(patching): third-party auto-approval as a first-class Update Ring control #3150 has shipped to BOTH prod regions (EU + US). Not met. Verified 2026-08-07:

  • git tag --contains f146d4027 returns zero tags — no release contains feat(patching): third-party auto-approval as a first-class Update Ring control #3150.
  • Latest release is v0.103.0, tagged 2026-07-31 — five days before feat(patching): third-party auto-approval as a first-class Update Ring control #3150 merged.
  • https://eu.2breeze.app/health and https://us.2breeze.app/health both report "version":"0.103.0".

  So the code currently running in both regions still reads patch_policies.sources. Merging and deploying this now would not merely break a rolling deploy — it would break both live regions the moment the migration applied.

Unblocks when: a release cutting from a main that includes f146d4027 has been deployed to EU and US, and /health reports that version in both. Re-verify with the three checks above rather than assuming the tag implies the deploy — per the deploy runbook, the hand-maintained service list has silently skipped services before.

Rebase note (2026-08-07)

This PR was stacked on ToddHebebrand/3rd-party-patch-update-rings (#3150). That PR was squash-merged, which discards the shared history, so all 14 of its commits on this branch started colliding with main's squashed copy — the PR went CONFLICTING with 23 conflicted files, none of which were actually this PR's work.

Resolved by replaying only this PR's own commit onto main (git rebase --onto origin/main 66f77811b) rather than hand-resolving. That left 1 commit / 8 files, down from 15 commits / 39 files. The single genuine conflict was migrateToConfigPolicies.ts — exactly the handoff described above — resolved in favour of this PR's version. Pre-rebase head b72c9e4eb is preserved locally on backup/3154-pre-rebase-b72c9e4eb.

Verification (re-run on the rebased tree, 2026-08-07)

• tsc --noEmit -p apps/api/tsconfig.json → exit 0, no output.
• apps/api full unit suite → 1283 files passed / 5 skipped, 20484 tests passed / 48 skipped.
• Repo-wide grep for patchPolicies.sources / patch_policies.sources: only three comment references remain (migrateToConfigPolicies.ts:491, aiAgentSdkTools.ts:1887, aiAgentSdkTools.mcpCoverage.test.ts:211) — no live readers or writers.
• patchPolicies schema object confirmed to have no sources field.
• Migration sorts after the 2026-08-13 ring backfill from feat(patching): third-party auto-approval as a first-class Update Ring control #3150; it has no ordering dependency on the sibling 2026-08-14-a-/-b- files (independent DROP COLUMN).

Closes #3151

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying breeze with    Cloudflare Pages

Latest commit:	0d45d0b
Status:	✅  Deploy successful!
Preview URL:	https://c91379d0.breeze-9te.pages.dev
Branch Preview URL:	https://chore-3151-drop-patch-polici.breeze-9te.pages.dev

View logs

[ToddHebebrand]

Heads-up from the base branch: 10fb309 on ToddHebebrand/3rd-party-patch-update-rings restored the primary.sources read in apps/api/src/scripts/migrateToConfigPolicies.ts (the hardcoded ['os'] silently dropped a not-yet-migrated partner's third-party opt-in on first run). That means this PR's schema-column removal now breaks that script at compile time — it needs to be handled here in the same change (snapshot-read via raw SQL, drop the read behind a column-existence check, or delete the script). Issue #3151's checklist has been updated accordingly.

🤖 Generated with Claude Code