fix(T11563): drizzle-conduit migration applies cleanly on fresh cleo.db (attachments collision)

[kryptobaseddev]

Root cause (P1 — clean-build conduit/agent crash)

E6-L3 (#900) routed the conduit domain into the consolidated project cleo.db. That DB already contains the docs-domain bare attachments table (id, sha256, attachment_json, ...). The conduit forward migration's CREATE TABLE IF NOT EXISTS attachments (conduit shape: slug, conversation_id, content BLOB, ...) therefore silently no-opped against the docs table, and the next statement —

CREATE INDEX IF NOT EXISTS attachments_conversation_idx ON attachments(conversation_id);

— crashed with no such column: conversation_id (the docs attachments table has no conversation_id). This broke cleo agent list (E_LIST: DrizzleError: Failed to run the query) and every cleo conduit * command on a fresh build.

The per-leaf unit test passed because ensureConduitDb ran against an isolated tmp cleo.db where the docs attachments table was never created — the full CLI creates it first. The migration's own "disjoint physical names" comment was wrong: attachments is the only conduit bare name that collides (with the tasks/docs domain).

Fix (root-cause, no integrity weakening)

Prefix the four conduit attachment-family tables/indexes/FK refs with conduit_ so they are physically disjoint from the docs attachments table — matching the consolidated cleo-project/conduit.ts schema and the exodus rename-map target (attachments → conduit_attachments):

• migration.sql + conduit-schema.ts: rename attachments/attachment_versions/attachment_approvals/attachment_contributors (+ their indexes, unique constraints, FK references) to conduit_*.
• migrate-signaldock-to-conduit.ts: PROJECT_TIER_TABLES is now {src, dest} pairs; copyTableRows accepts a destTableName so the legacy bare source names map to the prefixed destination names (latent cascade bug for pre-T310 installs).
• conduit-sqlite.test.ts: EXPECTED_LEGACY_TABLES updated to the prefixed names.

Verification

• Fresh XDG_DATA_HOME: cleo agent list → {success:true, data:[]} (was E_LIST); cleo conduit status reaches the app layer (E_CONDUIT: no agent credential — expected business response, not a migration crash).
• Migration replay proves the conduit migration now applies cleanly alongside a pre-existing docs attachments table; conduit_attachments_conversation_idx lands on conversation_id.
• @cleocode/core conduit suite (181 tests) + full @cleocode/runtime (120) green; the only core-suite failures are the pre-existing worktree-napi env failures (confirmed identical on clean origin/main).
• cleo check arch 5/5; lint-migrations --fail-on=error exit 0.

Closes T11563.

🤖 Generated with Claude Code