Merge remote-tracking branch 'origin/staging' into fix/deploy-trigger-registry-cycle

# Conflicts:
#	package.json

Author: waleedlatif1

package.json

@@ -31,10 +31,10 @@
     "check:cron-parity": "bun run scripts/check-cron-parity.ts",
     "check:api-validation:strict": "bun run scripts/check-api-validation-contracts.ts --check --enforce-boundary-baseline",
     "check:realtime-prune": "bun run scripts/check-realtime-prune-graph.ts",
-    "check:tool-request-boundary": "bun test scripts/check-tool-request-boundary.test.ts && bun run scripts/check-tool-request-boundary.ts",
+    "check:tool-request-boundary": "bun run scripts/check-tool-request-boundary.ts",
     "check:tool-registry-boundary": "bun run scripts/check-tool-registry-boundary.ts",
     "check:trigger-block-cycle": "bun run scripts/check-trigger-block-cycle.ts",
-    "check:sql-date-binding": "bun test scripts/check-sql-date-binding.test.ts && bun run scripts/check-sql-date-binding.ts",
+    "check:sql-date-binding": "bun run scripts/check-sql-date-binding.ts",
     "check:zustand-v5": "bun run scripts/check-zustand-v5-selectors.ts",
     "check:react-query": "bun run scripts/check-react-query-patterns.ts --check",
     "check:client-boundary": "bun run scripts/check-client-boundary-imports.ts --check",

scripts/check-migrations-safety.test.ts

@@ -330,7 +330,7 @@ const ANNOTATE_GUIDANCE =
   'is a contract-phase op. Confirm the old code no longer reads/writes it (it must have shipped in an earlier deploy — not this same PR), then acknowledge with a `-- migration-safe: <reason>` comment on the line above.'
 
 /** Lint a single migration's SQL. Returns only actionable findings. */
-export function lintSql(content: string): Finding[] {
+function lintSql(content: string): Finding[] {
   const lines = content.split('\n')
   const statements = parseStatements(content)
   const createdTables = new Set<string>()