Validate legacy external_snapshots_immutable trigger for migrations 005–007

[Lucenx9]

Motivation

• Restore validation was only requiring external_snapshots_immutable starting at migration 008, but the original trigger was created in migration 005 and expected through migration 007, allowing older schemas to pass validation without snapshot immutability.
• The gap weakens provenance/trust checks during backup/restore for installations at migrations 005–007 and must be fixed without changing runtime behavior for newer schemas.

Description

• Add a legacy required-trigger entry for external_snapshots_immutable that applies from minimumMigration: 5 up through maximumMigration: 7 and expects reject_external_history_mutation and its functionBodySha256 in src/onboarding/adapters/postgres/restore-validation.ts.
• Tighten required-trigger selection to honor an optional maximumMigration field so requirements can be gated to specific migration ranges in assessRestoredDatabaseEvidence.
• Add a unit test that verifies a migration-007 inventory with the original reject_external_history_mutation trigger is accepted and that an otherwise-identical inventory missing that trigger is rejected in tests/unit/onboarding/restored-database-validation.test.ts.
• Files changed: src/onboarding/adapters/postgres/restore-validation.ts and tests/unit/onboarding/restored-database-validation.test.ts.

Testing

• Ran formatting with pnpm exec prettier --write src/onboarding/adapters/postgres/restore-validation.ts tests/unit/onboarding/restored-database-validation.test.ts which completed successfully.
• Ran the impacted unit tests with pnpm exec vitest run --project unit tests/unit/onboarding/restored-database-validation.test.ts and all tests passed (23 passed).
• Ran type checks and linting with pnpm typecheck and pnpm lint which completed without errors.

---

Codex Task