chore: add a Postgres migration safety guard

Add a CI guard that checks new Prisma migrations for idempotent,
lock-safe DDL: creates must use IF NOT EXISTS, drops IF EXISTS, CREATE
TYPE, ADD CONSTRAINT and RENAME must sit in a guarded DO block, INSERTs
need ON CONFLICT, and indexes on existing tables must be built
CONCURRENTLY in a single-statement migration. The enforced cutoff date
is pinned in the `guard:migrations` script in
`apps/webapp/package.json`; `-- --all` audits the whole history locally.
A `-- migration-guard: allow <reason>` comment opts a single statement
out.

Mono-RevId: 7c937700bc4eae8b5b51fecdb60b620bf3c9807b