feat(broker): migrations-based install, roles, RLS, and job dependency groups

Replace the ad-hoc tables/procedures install layout with versioned,
ordered SQL migrations tracked in broker_schema_migrations. Add
optional least-privilege role provisioning (--with-roles), multi-tenant
row-level security, lease-based job claiming with stale-lease recovery,
and job dependencies -- both by job id and by fan-in job group. Add
Docker/Compose support for running the broker and its test suite.

pkg/broker/adapter/database.go

@@ -19,6 +19,11 @@ type DBAdapter interface {
 	// Begin starts a new transaction
 	Begin(ctx context.Context) (DBTransaction, error)
 
+	// Conn returns a single physical connection pinned out of the pool, for
+	// session-scoped state (e.g. advisory locks) that must survive across
+	// calls. The caller owns it and must Close() it when done.
+	Conn(ctx context.Context) (*sql.Conn, error)
+
 	// Exec executes a query without returning rows
 	Exec(ctx context.Context, query string, args ...interface{}) (sql.Result, error)