feat(broker): migrations-based install, roles, RLS, and job dependency groups

Replace the ad-hoc tables/procedures install layout with versioned,
ordered SQL migrations tracked in broker_schema_migrations. Add
optional least-privilege role provisioning (--with-roles), multi-tenant
row-level security, lease-based job claiming with stale-lease recovery,
and job dependencies -- both by job id and by fan-in job group. Add
Docker/Compose support for running the broker and its test suite.

pkg/broker/install/sql/migrations/0006_broker_set_tenant.sql

@@ -0,0 +1,13 @@
+-- broker.broker_set_tenant
+-- Sets the RLS tenant context for the current transaction (SET LOCAL semantics
+-- via set_config(..., true)). Callers must invoke this before enqueue/claim
+-- if they are not using the 'default' tenant.
+
+CREATE OR REPLACE FUNCTION broker.broker_set_tenant(p_tenant_id TEXT)
+RETURNS VOID
+LANGUAGE SQL
+AS $$
+    SELECT set_config('broker.tenant_id', p_tenant_id, true);
+$$;
+
+COMMENT ON FUNCTION broker.broker_set_tenant IS 'Sets broker.tenant_id for the current transaction only (SET LOCAL semantics)';