fix(security): remove obsolete preview migration fixture

docs/early-access/migration-compaction.md

@@ -60,8 +60,8 @@ Runtime grant provisioning remains a separate rollout responsibility.
 - `pnpm db:migrate` commits the verified transition and pending migrations.
 - Never run raw `drizzle-kit migrate` against an original-chain database. It does
   not perform the transition and would try to recreate existing objects.
-- The older `scripts/runs/migrate-preview.ts` is a historical `0009 → 0010`
-  rollout tool; do not use it after baseline adoption.
+- The historical `0009 → 0010` preview rollout tool was removed after baseline
+  adoption. Use the baseline-aware migration runner above.
 
 Supply an owner connection through the process environment:
 `MIGRATION_DATABASE_URL` (or `DATABASE_URL`), plus

lib/db/run-rollout.test.ts

@@ -1,49 +1,7 @@
 import { readFileSync } from "node:fs";
 import { describe, expect, it } from "vitest";
-import { assertRunMigrationTarget } from "@/scripts/runs/migrate-preview";
 
 describe("run migration rollout guard", () => {
-  const env = {
-    PREVIEW_RUNS_BRANCH_ID: "br-holy-sound-auugm104",
-    PREVIEW_RUNS_DATABASE_URL:
-      "postgresql://synthetic:synthetic@ep-dry-smoke-au7l7dzw-pooler.c-10.us-east-1.aws.neon.tech/neondb?sslmode=require",
-  };
-  it("requires explicit isolated preview credentials and never falls back to DATABASE_URL", () => {
-    expect(() =>
-      assertRunMigrationTarget({ DATABASE_URL: env.PREVIEW_RUNS_DATABASE_URL })
-    ).toThrow("preview_runs_branch_guard_failed");
-    expect(() =>
-      assertRunMigrationTarget({
-        PREVIEW_RUNS_BRANCH_ID: env.PREVIEW_RUNS_BRANCH_ID,
-        DATABASE_URL: env.PREVIEW_RUNS_DATABASE_URL,
-      })
-    ).toThrow("preview_runs_database_url_required");
-    expect(assertRunMigrationTarget(env).ownerUrl).toBe(
-      env.PREVIEW_RUNS_DATABASE_URL
-    );
-  });
-  it("rejects production, arbitrary hosts, database names and URL parameter target overrides", () => {
-    for (const override of [
-      { PREVIEW_RUNS_BRANCH_ID: "br-wild-boat-auv00x69" },
-      {
-        PREVIEW_RUNS_DATABASE_URL:
-          "postgresql://synthetic@production.invalid/neondb",
-      },
-      {
-        PREVIEW_RUNS_DATABASE_URL: env.PREVIEW_RUNS_DATABASE_URL.replace(
-          "/neondb",
-          "/other"
-        ),
-      },
-      {
-        PREVIEW_RUNS_DATABASE_URL: `${env.PREVIEW_RUNS_DATABASE_URL}&host=production.invalid`,
-      },
-      {
-        PREVIEW_RUNS_DATABASE_URL: `${env.PREVIEW_RUNS_DATABASE_URL}&options=-csearch_path=other`,
-      },
-    ])
-      expect(() => assertRunMigrationTarget({ ...env, ...override })).toThrow();
-  });
   it("keeps audit immutability and owner binding in migration SQL, including truncate", () => {
     const sql = readFileSync("drizzle/0010_run_records.sql", "utf8");
     for (const trigger of [