Harden CI and switch release builds to tagged immutable images

db/migrations/000001_foundation.sql

@@ -0,0 +1,10 @@
+-- Drive v2 uses forward-only migrations. Rollback is restore-or-fix-forward.
+CREATE EXTENSION IF NOT EXISTS pg_trgm;
+
+CREATE TABLE drive_metadata (
+    singleton BOOLEAN PRIMARY KEY DEFAULT TRUE CHECK (singleton),
+    installed_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+INSERT INTO drive_metadata (singleton) VALUES (TRUE);
+

db/queries/health.sql

@@ -0,0 +1,3 @@
+-- name: DatabaseHealth :one
+SELECT 1::BIGINT AS result;
+