fix(sqlitedb): verify the whole migration set at startup

[prorochestvo]

RequireMigratedSchema asserted only that __schema_migrations was non-empty — which is
true of every partially migrated database.

release.yml flips the bin/release symlink before it starts the beacon-migrate
one-shot, so for a few seconds the cron binaries resolve to a build newer than the schema.
They started fine and then died mid-query on the first new column, which is a confusing way
to learn the migration has not run yet. #131 was the first column addition in a while:
anything touching weather_user_cities in that window would have failed on no such column: notify_state. An interrupted migrator or a hand-rolled deploy reaches the same state with no
window at all.

What changed

The gate now compares the recorded filenames against the migrations the build embeds, and
refuses to start when any is missing — naming the first five and counting the rest, because a
fresh database is behind by all 33 and a startup line listing them buries the sentence that
says what to run. Callers pass migrations.MigrationsFS; sqlitedb takes an fs.FS and does
not import the migrations package, so the layering holds.

Failing closed with "schema is behind this build: run cmd/migrator..." replaces failing open
and reporting a missing column.

One-directional on purpose. A database carrying migrations this build does not know about
is accepted: that is exactly what a rollback to the previous artifact looks like, and refusing
would turn a rollback into an outage. An empty migration file is not counted as missing
either — it applies nothing, so it is never recorded, and that is Migrator.Verify's
complaint to make rather than a reason to keep a service down.

What was rejected

Reordering the deploy so the migration runs before the symlink flip. It closes the same
window, but it runs the old binary against the new schema for the duration, which is
only safe while every migration stays additive — a weaker invariant than the one this change
relies on, and it protects nothing outside the deploy. The code change covers the interrupted
migrator and the hand-rolled deploy as well. Reversing this means moving the two lines in
release.yml; nothing here depends on the current order.

Tests

Every migration recorded → nil. Unmigrated → schema not initialised. Build ahead of the
database → schema is behind this build, naming the file (verified to fail with the
comparison removed). Database ahead of the build → accepted. Empty migration file → not
counted as missing. Plus the message trimming, including that it does not scribble on the
caller's slice.

go vet, scripts/lint-checks.sh, golangci-lint clean; 41 packages green.

Refs #134