feat(broker): migrations-based install, roles, RLS, and job dependency groups

Replace the ad-hoc tables/procedures install layout with versioned,
ordered SQL migrations tracked in broker_schema_migrations. Add
optional least-privilege role provisioning (--with-roles), multi-tenant
row-level security, lease-based job claiming with stale-lease recovery,
and job dependencies -- both by job id and by fan-in job group. Add
Docker/Compose support for running the broker and its test suite.

Dockerfile

@@ -0,0 +1,40 @@
+# syntax=docker/dockerfile:1
+
+# ---- Build stage ----
+FROM golang:1.26-alpine AS builder
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+ARG VERSION=dev
+ARG COMMIT=unknown
+ARG BUILD_TIME=unknown
+
+RUN CGO_ENABLED=0 GOOS=linux go build \
+      -trimpath \
+      -ldflags "-w -s -X main.Version=${VERSION} -X main.Commit=${COMMIT} -X main.BuildTime=${BUILD_TIME}" \
+      -o /out/pgsql-broker \
+      ./cmd/broker
+
+# ---- Runtime stage ----
+FROM alpine:3.22
+
+RUN apk add --no-cache ca-certificates tzdata && \
+    addgroup -S broker && adduser -S -G broker -h /home/broker broker && \
+    mkdir -p /etc/pgsql-broker && \
+    chown -R broker:broker /etc/pgsql-broker
+
+COPY --from=builder /out/pgsql-broker /usr/local/bin/pgsql-broker
+
+USER broker
+WORKDIR /home/broker
+
+# broker.yaml is expected to be mounted at /etc/pgsql-broker/broker.yaml
+# (config.LoadConfig's default search path) -- no config is baked into the
+# image, since it holds database credentials.
+ENTRYPOINT ["pgsql-broker"]
+CMD ["start"]