feat: migration runner + schema_migrations ledger for tms_review (6 hand-applied migrations, no tracking)

[jakecelentano]

Scope

Add a migration runner and a schema_migrations ledger for the tms_review schema. Today there are 6 hand-numbered SQL files (schema/migrations/001…006) applied manually via psql (006's header documents Applied by: psql service=pg-superuser -f <this-file>). There is no tracking table, no ordering enforcement, and no idempotency guard — re-running or applying out of order is unprotected, and there is no way to ask the DB "which migrations are applied?"

Acceptance criteria

• tms_review.schema_migrations table (version, checksum, applied_at)
• tms migrate (or python3 -m tms.migrate) applies pending migrations in order, records them, refuses checksum-drifted re-application
• Backfill rows for already-applied 001–006
• Docs updated (README migration section); migration headers stop being the only provenance record

References

• Found during the 2026-07-20 stack evaluation
• schema/migrations/001–006
• Pattern reference: openagent uses migration checksum enforcement (bogocat/openagent schema/migrations)